Privacy Policy

Scope and Controller

This Privacy Policy ("Policy") describes how Thrive DeFi, LLC ("Thrive," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you visit thrive.fi, app.thrive.fi, or related subdomains, create an account, subscribe, connect an exchange, or otherwise use the Services. Thrive provides cryptocurrency market intelligence, trading journal tools, AI-assisted analysis, and educational content. Thrive is not a broker, exchange, custodian, or investment adviser.

Thrive DeFi, LLC is the controller for the personal information described in this Policy. Where Thrive processes personal data on behalf of an enterprise customer under a data processing addendum, Thrive acts as a processor and the customer acts as the controller. That processing is governed by the addendum and the customer's instructions.

This Policy applies to users worldwide. By using the Services, you acknowledge this Policy. Where the law requires consent, including for marketing email in certain regions, Thrive obtains that consent separately. Limitations of liability for the Services are set out in the Terms of Service. This Policy does not expand that liability.

• 8 The Green Ste #11044, Dover, DE 19901, United States
• Privacy and data requests: privacy@thrive.fi or support@thrive.fi
• Enterprise and due diligence: cs@thrive.fi

Information We Collect

Account and identity

When you register or authenticate, Thrive collects information such as:

• Email address and name, if you provide a name
• Authentication-provider user identifier and authentication metadata
• Account tier, subscription status, and preferences
• Multi-factor authentication status. Thrive does not store your MFA secrets

Billing and payments

Payment card and billing details are collected and processed by Thrive's payment processor. Thrive receives limited billing metadata, including customer ID, subscription status, last four digits, billing country, and tax identifiers where applicable. Thrive does not receive full card numbers.

Trading and platform data you provide

• Trading journal entries, notes, tags, and uploaded CSV files
• Watchlists, custom alerts, and dashboard configurations
• Workbench notebooks, formulas, strategies, and marketplace content you publish
• AI chat prompts and conversation history within the product
• Support messages and feedback you send

Exchange connections

If you connect an exchange, Thrive stores encrypted API credentials and syncs read-only account data, including balances, positions, and trade history, to power portfolio tracking and journal import. Thrive requests read-only permissions in its interface and onboarding. Thrive does not request withdrawal or transfer permissions. You are responsible for the permissions you grant on the exchange.

Information collected automatically

• Device type, browser, operating system, and language
• IP address and approximate location, at city or country level
• Pages viewed, features used, session duration, and referral URLs
• UTM campaign parameters and affiliate attribution cookies
• Error logs and performance metadata, from error monitoring and hosting logs
• Anti-abuse signals, including rate-limit counters and bot-detection metadata

Marketing and communications

• Email marketing opt-in status and drip-sequence enrollment
• Newsletter and waitlist sign-ups
• Sales chat session identifiers when you use the website chat

Cookies and Similar Technologies

Thrive uses cookies, local storage, and similar technologies for:

• Strictly necessary: authentication sessions, security (including bot-protection services), and load balancing
• Functional: affiliate attribution (thrive_ref) and journey attribution
• Analytics: first-party and third-party analytics on thrive.fi, including DataFast, to understand traffic, attribution, and product usage
• Advertising and measurement: an X (Twitter) Ads pixel on thrive.fi for campaign measurement and remarketing

On app.thrive.fi, Thrive uses strictly necessary cookies plus product analytics to operate and improve the product. You can control cookies in your browser. Disabling essential cookies may prevent login.

How We Use Information

Thrive uses personal information to:

• Provide, operate, and improve the Services
• Authenticate users and enforce account security
• Process subscriptions, credit purchases, marketplace transactions, and affiliate payouts
• Sync exchange data and populate your journal and portfolio views
• Generate AI-assisted signals, interpretations, coaching, and workbench responses
• Send transactional email, including receipts, alerts, password resets, and product notifications
• Send marketing communications where permitted, and with consent where consent is required
• Measure product usage, diagnose errors, and prevent fraud or abuse
• Comply with legal obligations and respond to lawful requests

Legal Bases

Where the GDPR, UK GDPR, or a similar law applies, Thrive relies on:

• Contract: to provide the Services you request
• Legitimate interests: security, fraud prevention, product analytics, and service improvement, balanced against your rights
• Consent: marketing email where required, and other processing for which consent is the appropriate basis
• Legal obligation: tax, accounting, and regulatory compliance

AI Processing

Thrive uses third-party AI inference providers to power signal interpretation, AI Coach, sales chat, workbench queries, and related features.

• Thrive sends only the data needed for each request, such as your prompt, journal context you invoke, and market-data parameters. Thrive does not send a full account export by default
• Thrive does not use your personal trading data to train public foundation models. AI providers process data under their enterprise or API terms and Thrive's instructions
• AI outputs are generated automatically and may be inaccurate. See the disclaimers in the Terms of Service
• Credit-consuming AI actions are logged for billing and abuse prevention

How We Share Information

Thrive does not sell your personal information. Thrive does not share your individual trading journal or exchange-synced data with other users except where you publish content, for example a Marketplace listing, or use a social feature you opt into.

Thrive may share information with:

• Service providers (processors) described under Subprocessors, under contracts that limit their use of the data
• Payment and tax: the payment processor, for billing, creator payouts, and tax calculation or collection
• Marketplace: aggregate subscriber counts to creators. The payout provider handles creator tax forms
• Affiliate partners: attribution data when you arrive through a referral link. Not your trading data
• Exchange partners: outbound click timestamps when you use a referral link to a third-party exchange. Thrive does not receive your exchange account data from those links
• Legal and safety: when required by law or legal process, or to protect the rights, safety, and integrity of the Services
• Business transfers: a merger, acquisition, or asset sale, subject to this Policy

Subprocessors

Thrive uses the following categories of providers. Each processes data on Thrive's instructions and under contractual safeguards:

• Authentication and identity: sign-in, sessions, and MFA
• Payments and billing: subscriptions, credits, payouts, and tax
• Cloud infrastructure: application hosting, database, and storage
• Transactional email: account and billing notifications
• Error monitoring: page URL, user agent, Thrive user ID, and stack traces. Not request bodies, API keys, or journal content
• Rate limiting and caching: abuse-prevention counters, using a hashed user ID or IP address
• AI inference: prompts you submit for AI features
• Product and marketing analytics: usage measurement, consent-gated where required
• Bot and abuse prevention: fraud and scraper protection
• Licensed market-data providers: asset symbols and query parameters only, never your identity

The vendor-level list is provided with an enterprise DPA. The category summary is at thrive.fi/legal/subprocessors. Questions: privacy@thrive.fi.

Data Security

Thrive uses technical and organizational measures including encryption in transit (HTTPS/TLS), encryption at rest for exchange API credentials, access controls, webhook signature verification, rate limiting, and environment-isolated secrets. No system is perfectly secure. You are responsible for safeguarding your account credentials and exchange API keys.

Data Retention

• Active accounts: data is retained while your account is active and as needed to provide the Services
• Deleted accounts: personal data is deleted or anonymized within a reasonable period after confirmed deletion, except where the law requires retention, including tax, billing disputes, and fraud prevention
• Backups: residual copies may persist in encrypted backups for a limited period before rotation
• Analytics logs: retained for the provider's default retention window

A category schedule is published at Data Retention.

Your Rights and Choices

Depending on where you live, you may have the right to:

• Access, correct, or delete your personal information
• Export your data in Dashboard, then Settings, then Export
• Object to or restrict certain processing
• Receive personal information in a portable format, where that right applies
• Withdraw consent where processing is based on consent
• Opt out of marketing email through the unsubscribe link
• Delete your account in Dashboard, then Settings, then Delete Account

Send requests to privacy@thrive.fi. Thrive responds within the time the applicable law requires, typically 30 days under the GDPR. Thrive may verify your identity before fulfilling a request.

Region-Specific Disclosures

European Economic Area and United Kingdom

You may lodge a complaint with your local supervisory authority. For transfers outside the EEA or the UK, Thrive relies on Standard Contractual Clauses, adequacy decisions, or both, where applicable.

California

California residents may request to know the categories of personal information Thrive collects, to delete or correct personal information, and to opt out of the "sale" or "sharing" of personal information. Thrive does not sell personal information. Thrive may "share" identifiers and usage data with analytics and advertising partners for measurement and advertising, as described in this Policy, including the X Ads pixel. Send requests to privacy@thrive.fi with the subject line "California Privacy Request." Thrive will not discriminate against you for exercising these rights.

Other regions

If local law grants additional privacy rights, contact Thrive and those rights will be honored to the extent the law requires. The Services are not directed at jurisdictions where use would violate local law.

International Transfers

Thrive is based in the United States. Your information may be processed in the United States and in other countries where Thrive's providers operate. Thrive uses appropriate safeguards for international transfers where the law requires them, including Standard Contractual Clauses and processor agreements.

Automated Processing

Thrive uses automated systems, including AI and rule-based engines, to generate signals, scores, and analytics. Those outputs are informational tools. They are not legal or financial decisions about you. Thrive does not make solely automated decisions that produce legal or similarly significant effects without human involvement.

Third-Party Services

The Services may link to third-party exchanges, social networks, and other websites. Their privacy practices are governed by their own policies, not by this Policy. When you leave Thrive through a partner referral link, the exchange's terms govern your relationship with that exchange. Thrive is not responsible for those practices.

Children

The Services are not directed to anyone under 18. Thrive does not knowingly collect personal information from children. If you believe a child has provided personal information, contact privacy@thrive.fi and Thrive will delete it.

Changes to This Policy

Thrive may update this Policy. The effective date at the top of this page is the current version. For a material change in how personal information is used, Thrive will provide additional notice where the law requires it, for example by email to active subscribers or by an in-product notice. Continued use after the effective date is acknowledgment where permitted.

Contact

Thrive DeFi, LLC
8 The Green Ste #11044, Dover, DE 19901, United States

Privacy: privacy@thrive.fi
Support: support@thrive.fi