1. Who is responsible?
Networking Union sp. z o.o., the owner of the Thruwise brand and website, is the service operator and controller of personal data processed for this service. Its contact and registration details appear below. Send privacy requests to hello@thruwise.com.
Service operator and data controllerNetworking Union sp. z o.o.ul. Jana i Jędrzeja Śniadeckich 20D/735-006 Rzeszów, PolandNIP: 5170427237 · REGON: 522679921
KRS: 0000984583Register court: Sąd Rejonowy w Rzeszowie, XII Wydział Gospodarczy Krajowego Rejestru Sądowegohello@thruwise.com
2. Data we process
Account data includes your email, account identifier and authentication information handled by Supabase Auth. If you use Google, we receive the account information it provides for sign-in, including name, email and avatar. Thruwise does not ask for access to your Gmail or Google contacts.
Your public profile may contain a name, handle, biography, role, company, areas in which you offer help, avatar and website or social links you supply. The service also stores problems, experiences, author updates, reactions, helpfulness confirmations, reports, moderation results and records needed to enforce limits.
A private introduction contains its participants, the related problem and experience, your reason for contact, questions, contact details, timestamps and delivery/read information. Only include information the recipient needs. Avoid sensitive information and other people’s confidential or personal data.
Problems saved for later form a private list linked to your account. You can access it after signing in on another device; it is not displayed to other users. You can remove individual items from the list.
3. Public, private and browser-only information
Published problems, experiences, author updates, public profiles and reaction information are accessible without an account. Parts of this content may also appear in previews or the recent activity feed. Public pages can be indexed, copied or shared by others. Follower and following counts are public. Follow relationships are stored with your account; we do not provide a public list of the people you follow. Following alone does not send notifications.
The account email is not a public profile field. Private introductions are available to their sender and recipient through access controls, rather than being public posts. Authorised operational access may be needed for security, support or a legal obligation; messages are not described as end-to-end encrypted.
Unpublished problem and response drafts are stored in your browser. Guest drafts use the current tab’s session storage; signed-in drafts use account-scoped local storage. They are not cross-device cloud drafts. Publication or another explicit submission sends content to the service. Browser storage and technical infrastructure remain described in the cookies notice.
Drafts for the From experience section are saved privately with your account on the server. A public snapshot is created only when you publish. Published posts and aggregate usefulness counts are public; drafts and voter identities are not public lists. We also store reports and records needed to enforce limits.
4. Purposes and legal grounds
We use data to provide the features you request, protect the community and handle enquiries. The grounds below apply to personal data; the service does not treat every processing operation as based on consent.
| Purpose | Main data | Ground under the GDPR, where applicable |
|---|---|---|
| Account and requested community features | Account, profile, posts, reactions and private contact | Performance of the service agreement — Article 6(1)(b). |
| Safety, moderation and prevention of abuse | Reports, submission records and technical/limit information | Legitimate interests in a safe service and protecting users — Article 6(1)(f). |
| Support and complaints | Correspondence and information needed to resolve the issue | Performance of the agreement or legitimate interests in responding and resolving disputes — Articles 6(1)(b) and (f). |
| Legal requirements and legal claims | Only information relevant to the obligation or claim | Legal obligation or legitimate interests in establishing, exercising or defending claims — Articles 6(1)(c) and (f). |
| Understanding service usage | Traffic statistics through Vercel Web Analytics and Betterdata | Legitimate interests in maintaining and improving the service — Article 6(1)(f), where personal data is involved. |
5. Infrastructure and recipients
Supabase provides authentication, the database and avatar storage. Vercel serves the website and provides technical logs and Web Analytics. Zenbox handles the domain’s DNS and contact email infrastructure.
When you sign in with Google, Google processes the sign-in under its own policies. An avatar hosted by Google or another external image host may cause your browser to connect to that host when displayed.
Resend is integrated for attempted private-contact notification emails. Such a notification can include the introduction and contact details. Account confirmation and password-recovery emails are handled through Supabase Auth’s configured mail delivery, not by a promise that every message uses Resend. We do not guarantee notification delivery.
Public content is shared with public readers. Contact details in an introduction are shared with the chosen participant. A labelled advertisement links to the advertiser’s own website; visiting it makes its own privacy rules relevant.
Betterdata provides additional visit and website-usage statistics and receives associated technical data. The cookies notice explains its browser-stored identifier.
6. Processing outside your country
Our infrastructure providers and their subprocessors may process data outside your country, including outside the European Economic Area. A database’s hosting location alone does not describe all authentication, email, support and infrastructure processing.
Transfers that fall under GDPR restrictions require an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, together with any required additional measures. Contact us for information about the safeguards relevant to your data and how to obtain a copy.
7. How long information is kept
Account and profile data is kept while the account is used to provide the service, then assessed when the account is closed or a valid erasure request is received. Published contributions are kept to make the community service available, subject to withdrawal, moderation and applicable erasure rights. Hiding or withdrawing content does not itself mean it has been erased.
Private introductions are stored to make them available to participants and handle related support, safety issues or legal claims. There is no automatic deletion schedule for these introductions. Moderation and limit records are retained according to their continuing safety purpose; a 24-hour rate-limit window is not a 24-hour deletion schedule.
Technical-log retention depends on the provider and configured service. Additional retention must relate to a necessary purpose such as resolving an incident, meeting a legal obligation or handling a claim.
Private application backups may contain personal data. They are kept outside the source repository to support recovery, not public browsing. Erasure requests must also be considered for copies under our control, including preventing erased data from being put back into ordinary use after a restore. Browser drafts remain until removed through the app or browser storage; the service does not centrally erase a device’s local storage.
8. Your rights and how to contact us
Where the GDPR applies, you may request access, correction, erasure, restriction or portability of your data, and object to processing based on legitimate interests. Rights depend on the relevant conditions and are not absolute. If a processing operation relies on consent, you can withdraw it without affecting earlier lawful processing.
Email hello@thruwise.com, preferably from the account’s address, and explain the request. We may ask for proportionate information to confirm identity. We respond without undue delay and normally within one month. Where the law permits an extension, we explain it within that first month.
You can complain to the competent data protection authority, including Poland’s President of the Personal Data Protection Office (UODO), where applicable. You do not have to give up any right to a judicial remedy.
9. Choices, automation and security
Providing data is voluntary, but an email/account is needed for authenticated features, and a chosen contact method is needed to send a private introduction. You can browse public pages without signing in.
The current advertising module selects by placement, page category and language; it does not build behavioural ad profiles or count ad clicks. Automated rules help validate submissions, enforce limits and moderate content. You can ask for a moderation decision to be reviewed by a person.
Access controls, authenticated actions and restricted operational access help protect data, but no internet service can promise absolute security. Keep credentials private. Report suspected exposure to hello@thruwise.com.
10. Age and updates
Thruwise is intended for people aged 16 and over. The service does not verify age using identity documents. Contact us if you believe a child’s data has been submitted inappropriately.
We update this notice when processing changes. The version date is shown above; significant changes will be communicated through the service or by email as appropriate. The cookies notice explains cookies and browser storage in more detail.