Think Brand FirstBusiness Suite & Growth Systems

Privacy Policy

Think Brand First — Last updated: 24 October 2026

This Privacy Policy explains how Think Brand First ("we," "us," or "our") collects, uses, stores, and protects information when you interact with us, including through our website, our internal business platforms (such as our CRM systems), and messaging channels including WhatsApp, powered by the WhatsApp Business Platform / WhatsApp Cloud API provided by Meta Platforms, Inc. It also covers Threadline Social, our software that lets a business manage the comments and messages it receives on its own Instagram, Facebook and Messenger accounts (Section 4).

1. Information We Collect

Depending on how you interact with us, we may collect:

• Contact information — such as your name, phone number, WhatsApp number, and email address.
• Business information — such as your company name, business category, and location, if you engage with us as a lead, customer, or business contact.
• Communication content — messages, inquiries, and attachments you send to us via WhatsApp, email, or our web forms, and messages we send to you (including automated welcome messages, order updates, appointment reminders, or support responses).
• Technical and usage data — such as message delivery status, timestamps, and interaction logs needed to operate and troubleshoot our messaging systems.

2. How We Use Your Information

• To respond to inquiries and provide customer support.
• To send transactional and business-related messages via WhatsApp (e.g. lead follow-ups, order/appointment updates, notifications you have requested or that relate to an existing business relationship).
• To manage our customer relationship management (CRM) records.
• To improve our services, products, and communications.
• To comply with legal obligations and enforce our terms.

3. WhatsApp Messaging

When you message us on WhatsApp, or when we message you (for example, after you submit an inquiry or become a lead/customer), that communication is processed through the WhatsApp Business Platform operated by Meta Platforms, Inc. Meta processes this data in accordance with its own WhatsApp Business Data Processing Terms. We only use WhatsApp messaging to communicate about business matters relevant to your inquiry, order, appointment, or ongoing relationship with us, and you may opt out of further messages at any time by replying "STOP" or contacting us directly.

4. Threadline Social (Instagram, Facebook and Messenger)

Threadline Social is used by businesses ("our customers") to handle the comments and direct messages that people send to the business's own Instagram professional account and Facebook Page. Two groups of people are involved, and we treat them differently:

• The business that signs up (the account holder): we decide how the information you give us is used, as described in this policy.
• People who comment on or message that business: the business decides why their messages are handled; we process them for the business, only to provide the service, and only on the business's instructions. If you are one of these people, the business you wrote to is the first place to ask about your information, and you can also write to us (Section 11).

What we receive

• From the business: name, email address, business name, password (stored only as a one-way hash), team members' names and email addresses, and the rules, templates, product list and knowledge-base answers the business enters.
• From Meta, with the business's permission (through Meta's own login screen, for the Pages and accounts the business chooses): the account's name, username, picture and ID, an access token (stored encrypted), and the comments, direct messages, story replies and lead-form answers sent to those accounts, with the sender's ID and the name and profile picture Meta shares with us, the time, and delivery status.
• From the business's Shopify store, if the business connects one: only what any visitor to the shop can see: product names, prices, availability, pictures and links. We do not ask for a store password or key and do not read customers or orders.

How we use it

• To show the conversations in one inbox, run the replies and rules the business has set up, answer with the business's own products, record leads, and show the business its statistics.
• To send the account emails (email confirmation, password reset, trial and plan notices) and to take payment for a plan.
• We do not sell this information, we do not use it to build advertising profiles, and we do not use messages to train our own models. Data we receive from Meta is used only to provide these features to the business that connected the account.

AI processing

If the business turns on AI replies or suggestions, the text of the message being answered, together with the business's own answers and product details needed for that reply, is sent to our AI model provider (Anthropic, the maker of Claude) which returns a draft. This happens only for messages the business has chosen to handle with AI, and the business controls whether a draft is sent automatically or waits for a person. AI drafts can be wrong; the business is responsible for the replies sent from its accounts.

Who else handles the data

• Meta Platforms, Inc. (Instagram, Facebook, Messenger): the channel the messages travel on, under Meta's own terms and policies.
• Razorpay: processes plan payments. We receive the payment status and plan details; we do not receive or store card numbers.
• The AI model provider described above, and the email delivery and hosting providers we use to run the service. These providers may process data on servers outside India.

How long we keep it

• While the account is active, conversations, leads and settings are kept so the business can use them.
• A workspace that stays on the free trial is read-only for 14 days after the trial ends (the business can still look at everything and download its data). After that it may be deleted with everything in it; we email the workspace owner before that happens. A business can also ask us to delete its workspace at any time.
• When a business disconnects an Instagram or Facebook account, the stored access token is erased at once and no further messages are received from it.

Security

Connections use HTTPS, access tokens are stored encrypted, passwords are stored only as one-way hashes, sign-in sessions use secure cookies, every workspace's data is kept separate, and sign-in attempts and email confirmation are rate limited. No system is perfectly secure, so we also ask businesses to keep their passwords private.

Deleting your data

You can ask us to delete the information connected to Threadline Social in any of these ways:

• From Facebook or Instagram: open Settings → Business Integrations (Facebook) or Apps and Websites (Instagram), find our app and choose Remove. Meta then tells us, and we erase the stored sign-ins of that account and show you a confirmation code.
• From inside Threadline Social: a workspace owner can disconnect any account at any time in Settings → Accounts.
• By email: write to hello@thinkbrandfirst.com from the address on the account, or, if you are a person who messaged a business, tell us which business and which account; we first check that the request comes from the account owner (or, for messages, from the person who wrote them), then delete the workspace or the messages concerned and confirm by email.

Step by step instructions are on our data deletion page.

5. How We Share Information

We do not sell your personal information. We may share information with:

• Service providers who help us operate our business (e.g. hosting providers, the WhatsApp Business Platform / Meta, and CRM software used internally).
• Legal authorities, where required by law or to protect our rights.

6. Data Retention

We retain your information for as long as necessary to fulfil the purposes described in this policy, maintain accurate business records, and comply with legal obligations. You may request deletion of your data at any time (see Section 8).

7. Data Security

We take reasonable technical and organizational measures to protect your information from unauthorized access, disclosure, alteration, or destruction.

8. Your Rights

You may contact us at any time to:

• Request access to the personal information we hold about you.
• Request correction or deletion of your information (see also the data deletion page).
• Opt out of receiving further WhatsApp or other communications from us.

9. Children's Privacy

Our services are intended for business use and are not directed at children. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date.

11. Contact Us