Privacy Policy
This is a translation provided for convenience. The Spanish version is the governing text; in case of any discrepancy, the Spanish version prevails.
At Thryp we respect the privacy of our users and are committed to protecting the personal information you share with us. This policy describes what data we collect, how we use it, with whom we share it, and your rights over it. It is our policy for the processing of personal data under Colombian Law 1581 of 2012 (Ley 1581 de 2012) and its implementing regulations (Colombia); see sections 11 through 13.
1. Information we collect
We collect information you provide to us directly (name, email address, phone number, company or organization, and information about your business when you create an account or request a demo) and information generated by your use of the product (chat interactions, campaigns, leads, SEO data). We also store anonymous hashes of IP addresses for security and abuse-prevention purposes. When you accept this policy and the Terms, we record the date, the version of each document, your IP address, and the browser used, as proof of your authorization.
2. Demo follow-up emails (remarketing)
If you sign up for a demo account and do not complete the conversion to a paid account, Thryp may send you up to four automated follow-up emails (days 1, 3, 7, and 14 after sign-up). These emails are intended to help you discover Thryp features that may interest you and to offer you support in completing your setup.
You may opt out of these emails at any time by clicking the unsubscribe link included at the bottom of each message, or by writing to us at [email protected]. When you unsubscribe, your record is immediately marked as "do not contact" and will no longer receive any future remarketing emails. This action is instantaneous and final.
3. Demo account restrictions (sandbox)
Demo accounts on Thryp have limited functionality by design, in order to protect the data of real users and prevent abuse of resources. Specifically, demo accounts cannot send real emails to leads, cannot connect external services via OAuth (Google, Square, etc.), cannot save persistent changes to campaigns or profiles, and are subject to a daily usage limit in the AI chat.
All of these restrictions are documented in the code and are enforced both at the frontend level (disabled buttons with a visible notice) and at the backend level (middleware that blocks any prohibited request with an explicit HTTP 403 response). If you need full access to these features, you may upgrade your account to the paid plan at any time from /upgrade.
4. How we use your information
- To provide and improve the Thryp services you have contracted.
- To create and manage your account, your brands, your integrations, and the Thryp tools you use, to provide you with support, and to contact you about the activation of your account or about a demo you request.
- To communicate with you about your account, news, and product updates.
- To send you Thryp's own advertising and offers (email, phone, WhatsApp, or SMS), only if you separately authorize it; you may withdraw that authorization at any time.
- To personalize the AI recommendations and responses you receive within the product.
- To prevent abuse, fraud, and malicious behavior (including the use of IP hashes for rate limiting).
- To comply with applicable legal and regulatory obligations.
5. Unsubscribe mechanism
Every remarketing email we send you contains a unique unsubscribe link generated with HMAC-SHA256, validated in constant time to prevent timing attacks. When you click that link, we immediately mark your record as "do-not-contact" and send no further automated emails. You may also write to [email protected] to request the complete deletion of your data.
6. With whom we share your information
We do not sell your personal data or share it with third parties so that they can send you their advertising. We share information only with service providers necessary to operate Thryp (hosting, payment processing via Square, AI model providers), each under data processing agreements. We may also share information if required by law.
7. Your rights
As the data subject, you have the right to know, update, rectify, export, and delete your personal data; to request proof of the authorization you gave us; to be informed of the use we make of your data; to revoke your authorization where there is no legal or contractual duty to retain the data; and to file complaints with the Superintendence of Industry and Commerce (SIC) of Colombia. To exercise these rights, write to us at [email protected]. We respond to inquiries within a maximum of 10 business days and to claims within a maximum of 15 business days. To delete your account and your data, see our data deletion page.
8. Data retention
We retain your data for as long as your account is active. When you close your account, we delete personally identifiable data within 30 days, except for data we are required to retain by law (billing, tax compliance).
9. Data from connected platforms (Meta, Google, TikTok, X, LinkedIn, Pinterest)
When you connect your social media or advertising accounts to Thryp using the "Connect" button in Settings, we store only the access tokens (encrypted with AES-256 via Laravel Crypt) and the minimum identifiers necessary to operate (Facebook Page ID, Instagram Business account ID, Meta Ads account ID, etc.). We do NOT store third-party post content, private messages, or data about users other than the owner of the connected account.
Specifically for Meta (Facebook + Instagram + Meta Ads + WhatsApp Cloud)
- What we read: the list of Pages you manage, the list of Instagram Business accounts linked to those Pages, the list of ad accounts you manage, aggregate metrics for your posts (likes, comments, reach), and metrics for your advertising campaigns (spend, impressions, clicks).
- What we write: posts that YOU explicitly approve from the content calendar in Thryp; replies to messages that YOU explicitly approve; and the creation, pausing, and reporting of advertising campaigns that YOU explicitly approve. Thryp never publishes or replies without direct human approval.
- How it is stored: access tokens are encrypted at rest. Tokens are never returned in API responses or included in logs. Decryption takes place only in memory at the moment of making the call to Meta, and the decrypted values are discarded immediately.
- How long: for as long as the connection is active. Upon disconnection ("Disconnect" button in Thryp, or from Facebook → Apps and Websites), the tokens are deleted immediately and the derived connections (Facebook, Instagram, Meta Ads) are also purged in cascade.
- Sharing with third parties: we do NOT share Meta data with third parties. It is used only within Thryp to operate the features described.
How to request the deletion of your Meta data
Three ways, all equivalent and all instantaneous:
- In Thryp: Settings → Connections → "Disconnect" on the Meta card.
- On Facebook: facebook.com/settings?tab=applications → search for "Thryp Marketing" → Remove. Meta notifies us automatically and we delete your data in less than 24 hours.
- By email: write to [email protected] with the subject "Meta data deletion". Confirmed response in less than 72 hours.
More details on our data deletion instructions page.
Specifically for Google (YouTube, Analytics, Search Console, Calendar, Google Ads, Business Profile)
Thryp accesses only the Google data of the account owner who connects the account, with the permissions (scopes) that the owner personally authorizes on Google's consent screen. Each permission is used solely for the function indicated:
- YouTube (
youtube): publish videos to the owner's channel, always after the owner's approval in Thryp, and read the channel's basic data (name, identifier) to display the connection in Settings. - Google Analytics (
analytics.readonly): read traffic and conversions (GA4) for the owner's properties in order to display them in Thryp's analytics dashboard. Read-only. - Search Console (
webmasters.readonly): read queries, clicks, and impressions for sites the owner has already verified, for SEO recommendations. Read-only. - Google Calendar (
calendar): create, update, and cancel events for appointments the owner confirms, and read the owner's availability so as not to schedule over existing events. - Google Ads (
adwords): read the owner's accounts, campaigns, and metrics, and create, pause, or resume only the campaigns the owner explicitly authorizes. - Google Business Profile (
business.manage): read and reply to reviews and publish updates on the owner's listings, always after the owner's approval.
How it is stored and for how long: we store only the access tokens (encrypted with AES-256) and the minimum identifiers necessary (for example, Google Ads account ID or Analytics property ID). Data read from Google is used at that moment to display it to the owner and is not used to train generalized AI models. Upon disconnection, the tokens are deleted from Thryp immediately, and you may also revoke access at any time from your Google account.
How to delete your Google data: in Thryp, Settings → Connections → "Disconnect" on the Google card; or from your Google account at myaccount.google.com/permissions → Thryp → "Remove access"; or by writing to [email protected].
Google API Services User Data Policy — Limited Use. Thryp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Thryp uses data received from Google APIs only to provide and improve the user-facing features described above. We do not transfer or sell this data to third parties, do not use it for serving advertisements, and do not allow humans to read it except with the user's affirmative agreement, for security purposes, to comply with applicable law, or for internal operations with aggregated and anonymized data. We do not use Google user data to develop, improve or train generalized AI or machine-learning models.
10. Contact
If you have questions about this policy or how we handle your data, write to us at [email protected].
11. Data controller and authorization
The data controller of your personal data is TECNOLOGIA MASTERWEB SAS, Tax ID (NIT) 900947569-8, domiciled at Cra. 64 No. 24-47, Bogotá D.C., Colombia (postal code 111321), the company that owns the Thryp, Senty, Masterweb Solutions, and Masterweb AI brands and that operates Thryp. Contact for personal data matters: [email protected].
When you sign up, Thryp asks you to expressly accept these documents (the Terms and Conditions, this Privacy Policy, and the data deletion page) and to authorize the processing of your personal data for the purposes described here. We store that authorization together with its date, the version of each document, your IP address, and your browser, and we will ask you for it again whenever we change any of these documents.
12. Our own commercial communications
If you give us your authorization, we will use your name, email address, phone number, and company to send you advertising, news, and offers of TECNOLOGIA MASTERWEB SAS and its brands (Thryp, Senty, Masterweb Solutions, and Masterweb AI) by email, phone, WhatsApp, or SMS. This authorization is optional and separate from the authorization required to use the service. We will never sell or assign this data to third parties so that they can send you their advertising. You may withdraw this authorization at any time using the unsubscribe link in each email or by writing to [email protected]; withdrawing it does not affect the use of your account.
13. International data transfer
The servers on which Thryp is hosted and some of the providers necessary to deliver the service (for example, AI model providers and payment processing providers) are located in the United States. By accepting this policy, you authorize the transfer and storage of your data on those servers, where it is processed with the same security measures and solely for the purposes described in this policy.