Privacy Policy

Effective 23 October 2026

This policy explains what personal data Thunderclap collects about the people who visit thunderclap.dev, sign in to the dashboard and work in organisations, why, and what rights they have. It is written to meet the EU General Data Protection Regulation (GDPR).

Who we are

The controller of your personal data is [Legal entity name], [Registered address] ([Company registration number, VAT number]). For anything about your data, write to thunderclap@bside-tech.com.

What this policy doesn't cover

Our customers use Thunderclap to send realtime messages to their own users. When their apps send personal data through the service (user ids, presence information, message contents, the IP addresses of connecting devices), we process it on the customer's behalf, as a processor, under our Data Processing Agreement. The customer is the controller of that data, and its own privacy policy applies. If you use an app built on Thunderclap, contact the company behind it about your data; we'll help them answer you.

What we collect, why, and on what legal basis

Data	Why	Legal basis
Account: your email address, the name you show your teammates, and the date you signed up	To create your account, sign you in and send you messages about the service	Performance of our contract with you (Art. 6(1)(b))
Sign-in codes: a one-time code sent to your email	To sign you in without a password	Performance of contract (Art. 6(1)(b))
Passkeys, if you add any: each one's public key, the name you give it, the model of authenticator holding it (not your device itself), whether it syncs, and when you added it. Your fingerprint, face or PIN never leave your device	To let you sign in with a passkey	Performance of contract (Art. 6(1)(b))
Sessions: your IP address and browser (user agent) for each sign-in	To keep your account secure and spot suspicious sign-ins	Our legitimate interest in securing accounts (Art. 6(1)(f))
Organisations: their name, company size, members, roles and invitations	To run organisations and control who can manage them	Performance of contract (Art. 6(1)(b))
Apps: names, settings, webhook endpoint URLs; secrets, stored encrypted	To provide the service you configured	Performance of contract (Art. 6(1)(b))
Usage: connection and message counts per app and hour	To show your usage, apply your plan's limits and bill you	Performance of contract (Art. 6(1)(b)); legal obligations for invoices (Art. 6(1)(c))
Technical logs: requests to our servers, which may include IP addresses	To operate the service, fix faults and prevent abuse	Our legitimate interest in running a secure, reliable service (Art. 6(1)(f))
Support: what you write to us, and our replies	To answer you	Performance of contract, or our legitimate interest in answering enquiries (Art. 6(1)(b), (f))
Launch waitlist (from before Thunderclap opened): email address, the plan you looked at, optional survey answers (company name, size, note)	To tell you once that Thunderclap is open	Your consent (Art. 6(1)(a)), which you can withdraw at any time

When paid plans become available, we will also process billing details (billing name and address, tax number, invoices) to charge you and meet our accounting obligations. Card details will be handled by our payment provider, not stored by us. We will update this policy before then.

We don't sell your data, use it for advertising, or make decisions about you based solely on automated processing.

Cookies and local storage

Session cookie: set when you sign in, to keep you signed in. It is strictly necessary.
Passkey cookie: set for a few minutes while you add a passkey or sign in with one, to tie your device's answer to our request. It is strictly necessary.
Theme preference: if you choose light or dark mode, your browser stores the choice locally. It is never sent to us.

We use no analytics, advertising or third-party cookies, and the site loads no third-party scripts or fonts. Because we only use storage that is strictly necessary for what you ask for, we don't ask for cookie consent.

Who receives your data

We use these service providers (processors), which act only on our instructions:

Subprocessor	Purpose	Location	Transfer safeguards
Cloudflare, Inc.	Hosting of the website and the realtime engine (Workers, Durable Objects, D1, KV, Queues, Analytics Engine), logs, DNS and network protection	Global edge network; company in the United States	EU–US Data Privacy Framework; Standard Contractual Clauses
Resend, Inc.	Sending sign-in codes and service emails	United States	Standard Contractual Clauses

We may also disclose data when the law requires it, to protect our rights or users' safety, or to a company that takes over the service, which would remain bound by this policy.

Transfers outside the European Economic Area

Some of our providers are based in the United States, or process data in their global networks. We rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise, together with the providers' security measures.

How long we keep it

Data	Kept
Account, organisations and apps	While your account exists, then deleted within 30 days of your request to delete it
Sessions	Until they expire, 7 days after you last use them, or until you sign out
Sign-in codes	10 minutes
Usage counts	As long as needed for billing and our accounting obligations (up to 10 years for data behind invoices)
Technical logs	Up to 7 days
Support conversations	Up to 2 years after the conversation ends
Launch waitlist	Until the launch email is sent, or earlier if you ask

Deleted data can remain in our database backups for up to 30 days, after which it is overwritten.

Your rights

Under the GDPR, you have the right to:

access your data and get a copy of it;
correct data that is wrong;
delete your data;
restrict or object to processing based on our legitimate interests;
receive the data you gave us in a portable format;
withdraw consent at any time, where processing relies on it, without affecting processing before.

To use any of them, write to thunderclap@bside-tech.com from the email address of your account. We will answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.