Privacy Policy

This Privacy Policy explains how thrml LLC collects, uses, shares, and protects your personal information when you use our platform. Washington and Nevada residents: please also see our Consumer Health Data Privacy Policy, which governs wellness-related data.

1. Information We Collect

1.1 Information You Provide

When you create an account or use our platform, we collect:

• Name, email address, and phone number
• Profile photo (optional)
• Payment information (processed and stored by Stripe — we do not store card numbers)
• Government-issued ID and a self-captured photograph for Hosts during identity verification. Verification is performed by Stripe Identity, which uses facial-comparison technology to match your selfie to your ID. thrml receives only the verification outcome (verified / failed) — we do not receive or store your ID images or biometric data. Stripe's processing is described in Stripe's Privacy Policy.
• Listing details provided by Hosts (photos, descriptions, pricing, availability)
• Messages sent through the platform between Hosts and Guests
• Reviews and ratings submitted after completed bookings

1.2 Information Collected Automatically

When you use the platform we may collect:

• Device type, browser, operating system, and IP address
• Pages viewed, time spent on pages, and navigation patterns
• Booking and transaction history
• Location data if you grant permission (used for map-based search features)
• Cookies and similar tracking technologies

1.3 Information from Third Parties

We may receive information from:

• Stripe: payment status, payout eligibility, and identity verification status
• Social media platforms if you choose to connect your account
• Analytics providers

2. How We Use Your Information

We use your information to:

• Create and manage your account
• Process bookings and payments
• Send booking confirmations, access codes, and session reminders
• Facilitate communication between Hosts and Guests
• Display listings and enable search functionality
• Promote Host listings on thrml's social media and marketing channels (Hosts may opt out)
• Respond to support requests and resolve disputes
• Detect and prevent fraud, abuse, and platform policy violations
• Comply with legal obligations
• Improve and develop our platform and services

3. How We Share Your Information

3.1 With Other Users

When a booking is made, limited information is shared between Hosts and Guests, including name, profile photo, and relevant booking details. Access codes are shared only with the confirmed Guest.

3.2 With Service Providers

We share information with trusted third-party service providers who help us operate the platform, including:

• Stripe (payment processing and Host identity verification)
• Resend or similar providers (transactional email delivery)
• Supabase (database and authentication infrastructure)
• Vercel (platform hosting)
• Google (Google Analytics and Google Ads — site analytics and advertising measurement)
• Meta (Meta Pixel and Conversions API — advertising measurement)
• Analytics and performance monitoring tools

These providers are contractually obligated to protect your information and use it only for the purposes we specify.

3.3 For Marketing

With Host consent, we may share listing content (photos, descriptions, location) publicly on thrml's social media channels for promotional purposes. We do not sell Host or Guest personal data to advertisers.

3.4 Legal Requirements

We may disclose information when required by law, court order, or government authority, or to protect the rights, property, or safety of thrml, our users, or the public.

3.5 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of thrml's assets, user information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4. Cookies and Tracking

We use cookies and similar technologies to maintain sessions, remember preferences, and analyze platform usage. You can manage analytics and advertising cookies at any time through Cookie Settings (also in the footer bar). Declining analytics cookies stops Google Analytics, Google Ads tags and the Meta Pixel from loading on your device. Disabling essential cookies in your browser may affect platform functionality.

We use the Meta Pixel and similar advertising technologies to measure the performance of our advertising. In addition to the Meta Pixel, we use the Meta Conversions API to send certain event data (such as sign-ups and bookings) to Meta directly from our servers, along with hashed identifiers such as a hashed email address. Hashing means Meta cannot read the raw identifier, but can match it against its own user base for advertising measurement. We only send Conversions API data for users who have consented to advertising cookies; opting out via Cookie Settings or the "Do Not Sell or Share My Personal Information" mechanism stops both Pixel and Conversions API sharing. We do not include the type of wellness service you book in data shared with advertising platforms.

We also use Google Ads conversion tracking to measure the performance of our Google advertising. If you accept advertising cookies, the Google tag records actions such as starting host sign-up, creating a first listing or completing a booking, and we share these key events from Google Analytics with Google Ads for the same purpose. Google may use cookies to recognize your browser across websites in order to measure and attribute ad performance. Google tags load only after you consent to analytics and advertising cookies, and opting out via Cookie Settings or the "Do Not Sell or Share My Personal Information" mechanism stops them. You can also manage Google's ad settings at adssettings.google.com and read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.

Ad attribution on thrml. When you arrive on usethrml.com from one of our ads, we save the campaign details in the link (UTM parameters such as the campaign and ad identifiers, and the ad click ID added by Meta or Google) in a first-party cookie on usethrml.com for up to 30 days. If you complete a booking in that time, we store those campaign details with the booking so we can see which of our ads lead to bookings and measure our advertising spend. This information stays in thrml's own systems: it is not sent to advertising platforms by this feature and is not used to build a profile of you across other websites.

Under some state privacy laws (including California's CPRA), the use of these technologies may be considered a "sale" or "sharing" of personal information. You can opt out of this sharing at any time using the "Do Not Sell or Share My Personal Information" mechanism described in Section 7, or by adjusting your cookie preferences via Cookie Settings.

5. Data Retention

We retain your personal data only for as long as necessary to provide our services, meet legal obligations, resolve disputes, and enforce our agreements. The table below summarises our standard retention periods.

Early deletion requests: You may request early deletion of your data at any time by contacting hello@usethrml.com. We will action your request within 30 days, subject to the legal retention requirements noted above. Deletion of booking and transaction records may not be possible where retention is required for tax or legal compliance.

Third-party retention: Data processed by our service providers (Stripe, Google, Meta, Supabase, Resend) is subject to their own data retention policies. We encourage you to review each provider's privacy policy for details.

6. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal data, subject to legal retention requirements
• Portability: Request your data in a portable format
• Opt-out: Opt out of marketing communications at any time
• Restrict processing: Request that we limit how we use your data in certain circumstances

To exercise any of these rights, contact us at hello@usethrml.com or submit a request through our privacy request form at usethrml.com/privacy-request. We will respond within 30 days.

7. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected, the right to delete, and the right to opt out of the sale of personal information. California residents have the right to opt out of the "sale" or "sharing" of personal information. While thrml does not sell personal information for money, our use of advertising technologies such as the Meta Pixel, Conversions API and Google Ads tags may constitute "sharing" under the CPRA. You may opt out at any time via Cookie Settings, the "Do Not Sell or Share My Personal Information" link in our footer, by contacting us at hello@usethrml.com, or via our privacy request form at usethrml.com/privacy-request.

Other U.S. State Privacy Rights. Residents of certain other states (including Virginia, Colorado, Connecticut, and others with comprehensive privacy laws) may have similar rights to access, correct, delete, and opt out of certain processing of their personal information. Washington and Nevada residents have additional rights regarding consumer health data, described in our Consumer Health Data Privacy Policy. To exercise any such rights, contact us at hello@usethrml.com and we will respond as required by applicable law.

8. Children's Privacy

The thrml platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected information from a minor, we will delete it promptly.

9. Security

We implement industry-standard security measures including encryption in transit (TLS), encrypted storage, access controls, and regular security reviews. However, no system is completely secure. We encourage users to use strong passwords and protect their account credentials.

In the event of a data breach that affects your rights or freedoms, we will notify affected users as required by applicable law.

10. Third-Party Links

The platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via notice on the platform. The date at the top of this policy reflects the most recent revision.

12. Contact

For privacy-related inquiries, data requests, or to report a concern, contact us at: hello@usethrml.com or via our privacy request form: usethrml.com/privacy-request