Warm Thread helps you notice when a client goes quiet. To do that we process a deliberately small amount of email data. This page explains exactly what we hold, what we never hold, where it lives, and how to get rid of it.
Who we are
Warm Thread is an independent service, built and operated from France. For any privacy question or request — including our full legal entity details — write to hello@warmthread.app. We answer every request within 30 days.
Two different roles
For your account data (your login email, your settings) we are the data controller.
For the email data you send us — which includes personal data about your clients — you are the controller and we act as your processor. We only process it to provide the service to you, following your instructions. A Data Processing Agreement is available on request.
What we store
- Account: your email address, an encrypted password (handled by Supabase Auth — we never see it), your digest hour, timezone, quiet-day threshold, and your unique Warm Thread address.
- Email metadata: sender and recipient addresses, display names, subject lines, timestamps, and whether a message was sent by you or received from a client. This is what silence detection runs on.
- One message excerpt per thread: up to about 4,000 characters of the most recent message, so an AI follow-up draft can reference the actual conversation. It is encrypted (AES-256-GCM) with a key held outside the database, and it is deleted automatically 30 days after it was received.
What we never store
- Full email bodies or attachments.
- Any access to your mailbox. Warm Thread has no connection to your email account — it only receives the messages you explicitly CC or BCC to your Warm Thread address.
- The AI drafts we generate. They are created when you open the link, shown once, and never written to our database.
- Payment card details (there is no paid plan yet).
How email reaches us
You add your unique Warm Thread address (…@in.warmthread.app) to the recipients of emails you care about. Those messages are delivered to our email provider, Resend, which passes them to Warm Thread. We extract the metadata and the single excerpt described above; the rest is discarded on our side. Resend holds received messages on its own systems according to its retention policy.
Why we may process it (legal bases)
- Performance of a contract: providing the service you signed up for.
- Legitimate interests: keeping the service secure and preventing abuse.
Who else is involved (subprocessors)
- Supabase — database and authentication. Hosted in the EU (Frankfurt).
- Vercel — application hosting. EU region (Frankfurt).
- Resend — receives your incoming mail and sends your digests. EU region (Ireland).
- Anthropic— generates the follow-up draft. When you open a draft link, the decrypted excerpt for that one thread is sent to Anthropic's API and processed under its commercial terms, which exclude using the content to train models. Anthropic is based in the United States; the transfer relies on the safeguards in their data processing terms.
Where data lives and how long
Your database and application run in the European Union. Email excerpts are deleted 30 days after receipt. All other data is kept until you delete it: removing a contact removes their threads, and deleting your account removes everything — account, settings, address, contacts, threads and excerpts — permanently and immediately, via Settings → Delete account.
Security
Data is encrypted in transit. Message excerpts are additionally encrypted at rest with a key stored outside the database, so a database compromise alone does not expose their content. Every database table enforces row-level security so one account cannot read another's rows. Our administrative accounts require two-factor authentication. If a breach affects your data, we notify you without undue delay and, where required, the French supervisory authority (CNIL) within 72 hours of becoming aware.
Cookies
We set only the cookies required to keep you signed in. There is no analytics, no advertising, and no third-party tracking on this site.
Your rights
You can request access to your data, correction, deletion, a portable copy, or object to processing — write to hello@warmthread.app. If you are a Warm Thread customer and one of your clients contacts us directly, we will refer them to you as the controller and help you respond. You also have the right to lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.
Children
Warm Thread is a business tool and is not intended for anyone under 18.
Changes
If we change this policy in a way that affects how we handle your data, we will email you before it takes effect.