[SQUARE BRACKETS]are placeholders to be finalized.Thunderbolt PM — Privacy Policy
Effective Date: [DATE]
1. About This Policy
1.1 This Policy explains how Thunderbolt Group, LLC ("Thunderbolt," "we," "us") collects, uses, discloses, and retains personal information in connection with Thunderbolt PM at pm.tbolt.ai.
1.2 This Policy applies to Thunderbolt PM specifically. Our general website privacy policy at thunderboltgroup.com governs our marketing site, and Thunderbolt CRM has its own policy.
1.3 Capitalized terms not defined here have the meaning given in the Terms of Use.
2. Our Role
2.1 For account information, Workspace Content, and Time Records within Thunderbolt PM, we act as the business/controller and this Policy governs how we handle it.
2.2 Where your organization administers a Thunderbolt PM workspace, that organization decides who has access, what work is recorded, and how Time Records are used. Questions about those decisions should be directed to your organization.
2.3 If you are an individual whose information appears in a card or attachment but you are not a user, see Section 12.
3. Notice at Collection
The table below is our notice at or before the point of collection.
| Category | Examples | Purpose | Retained | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, work email, username, account ID, profile photo, IP address | Create and secure your account; authenticate; support | [RETENTION] | Hosting and authentication providers |
| Account credentials | Password (hashed), authentication tokens | Authenticate and secure access | Duration of account | Authentication providers |
| Workspace Content | Boards, lists, cards, descriptions, checklists, comments, attachments | Deliver core project-management functionality | [RETENTION] | Hosting and AI model providers |
| Time Records | Time entries, timers, billable and non-billable designations, timesheets, time reports | Record work against cards; produce timesheets, reports, and approvals | [RETENTION — see 11.3] | Hosting providers; your organization's administrators and approvers |
| Approval and audit records | Submissions, approvals, requests for changes, card history, audit log | Evidence the integrity of the work record | [RETENTION] | Hosting providers |
| Internet and network activity | Sign-ins, page and feature usage, changes, device and browser information | Operate, secure, troubleshoot, and audit the service | [RETENTION] | Hosting and monitoring providers |
| Professional information | Job title, role, permissions, team membership | Provision access and permissions | Duration of account | Hosting providers |
| Inferences | AI-generated summaries, drafts, and suggestions derived from Workspace Content | Provide AI Features | [RETENTION] | AI model providers |
3.2 We collect this information from you directly and automatically as you use the platform.
3.3 We do not collect personal information from data brokers or public-record aggregators for Thunderbolt PM. [CONFIRM]
4. Sensitive Personal Information
4.1 Thunderbolt PM is not designed to collect sensitive personal information, and Terms of Use Section 11.7 prohibits entering it into AI Features.
4.2 Account log-in credentials are treated as sensitive personal information under California law. We collect and use them solely to authenticate you and do not use them to infer characteristics about any individual. Accordingly, the right to limit the use of sensitive personal information does not apply to this processing. [LEGAL REVIEW — Cal. Civ. Code 1798.121(d)]
4.3 If you enter other sensitive information into the platform contrary to the Terms of Use, you remain responsible for it, and we will handle it under this Policy until deleted.
5. How We Use Personal Information
We use personal information to:
- (a) provide, operate, and maintain Thunderbolt PM;
- (b) authenticate users and secure accounts;
- (c) record time against work and produce timesheets, reports, and approvals;
- (d) provide AI Features as described in Section 7;
- (e) respond to support requests;
- (f) monitor, troubleshoot, and improve performance and reliability;
- (g) detect, investigate, and prevent fraud, abuse, and security incidents;
- (h) maintain approval and audit records;
- (i) comply with legal obligations and enforce our Terms; and
- (j) communicate with you about the service, including changes to this Policy.
5.2 We do not use your information for behavioral advertising, and we do not build advertising profiles. [CONFIRM]
5.3 We do not use Thunderbolt PM data to make automated decisions about individuals' employment, performance, or compensation. Time Records and reports are made available to your organization, which decides how to use them. [CONFIRM — if automated scoring or ranking of workers is ever added, this section requires revision and additional obligations may attach]
6. Legal Bases
[CONFIRM whether Thunderbolt PM will have EU or UK users. If not, this section can be omitted. If yes: contract necessity for core service delivery, legitimate interests for security and recordkeeping, consent for the optional AI-improvement setting, and legal obligation where applicable. Note that consent is generally not a valid basis in an employment context because of the imbalance of power — an important point for a timesheet product.]
7. AI Features and AI Agents
This section supersedes any general statement about automated processing in our corporate privacy policy as it relates to Thunderbolt PM.
7.1 What the AI Features do. Thunderbolt PM includes AI Features that read information available within a workspace — including cards, descriptions, comments, and attachments — and use it to draft, summarize, or prepare work.
7.2 AI Agents. Thunderbolt PM also includes AI Agents: automated accounts that are assigned to cards, perform work, log time against that work, attach files, post comments, and submit completed work for approval. AI Agent activity is attributed to the agent account and is visible in card history and reports alongside human activity.
7.3 A person must approve the work. AI Agents cannot mark work complete. When an AI Agent submits a card as finished, the platform converts that submission into a pending-approval state requiring a human to approve it or request changes. This control is enforced by the platform itself.
7.4 No decisions with legal or significant effects. Thunderbolt PM does not use AI to score, rank, profile, or evaluate individuals, and does not make decisions producing legal or similarly significant effects — including decisions about employment, performance, compensation, credit, housing, insurance, education, or access to essential services. [CONFIRM — this is a stronger commitment than it appears in a timesheet product, and must be revisited if any worker-scoring feature is contemplated]
7.5 Model providers. Content processed by AI Features is transmitted to third-party model providers: [NAME PROVIDERS]. These providers process content solely to return output to us and are contractually prohibited from retaining it beyond what is necessary to deliver the service or using it to train their models. [CONFIRM AGAINST ACTUAL CONTRACTS]
7.6 Training. We do not use your content to train or fine-tune AI models, including evaluation datasets and prompt logs, unless you have separately enabled the optional AI-improvement setting in your account. That setting is off by default, is not required to use Thunderbolt PM, and can be turned off at any time in Settings without any effect on your access or features. [CONFIRM BEFORE PUBLICATION — this is the highest-exposure statement in this Policy]
7.7 Accuracy. AI output may be incomplete or inaccurate. It should be reviewed before it is relied upon.
8. How We Share Personal Information
8.1 We share personal information only as described here:
| Recipient category | Purpose | Examples |
|---|---|---|
| Hosting and infrastructure | Operate the platform | [NAME] |
| AI model providers | Deliver AI Features | [NAME] |
| Authentication providers | Sign-in | [NAME] |
| Email and communications | Transactional email and notifications | [NAME] |
| Monitoring and error reporting | Reliability and security | [NAME] |
| Professional advisers | Legal and accounting | As needed |
8.2 Within your organization, your Workspace Content and Time Records are visible to other Authorized Users, administrators, and approvers according to the permissions your organization sets. This is how the product works and is not a disclosure to a third party.
8.3 We may also disclose personal information (a) to comply with law, legal process, or a lawful government request; (b) to enforce our Terms; (c) to protect the rights, safety, or property of Thunderbolt, our users, or the public; and (d) in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy continuing to apply.
8.4 A current list of subprocessors is maintained at [SUBPROCESSOR PAGE URL].
9. We Do Not Sell or Share Personal Information
9.1 We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding 12 months.
9.2 We do not knowingly sell or share the personal information of anyone under 16.
9.3 Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" link is required. If this ever changes, we will update this Policy and provide the required mechanism before doing so.
10. Time Records and Workplace Monitoring
10.1 Thunderbolt PM records time against cards and produces timesheets, reports, and approvals. Time Records identify the individual to whom they relate.
10.2 Time Records are visible to administrators, approvers, and others with reporting permissions in the organization that administers the workspace.
10.3 If your employer or engaging organization uses Thunderbolt PM to record your working time, that organization decides what is recorded and how it is used. Questions about the purpose of the recording, who can see it, and how it affects you should be directed to that organization. We provide the tool; we do not set your organization's policy.
10.4 We do not use Time Records to evaluate, score, or rank individuals. See Section 7.4.
11. Retention
11.1 We retain personal information as follows:
| Data | Retention |
|---|---|
| Account information | Duration of account, then [PERIOD] |
| Workspace Content (boards, cards, comments, attachments) | Duration of account, then [PERIOD] |
| Time Records and timesheets | [PERIOD — see 11.3] |
| Approval and audit records | [PERIOD] |
| Activity and sign-in logs | [PERIOD] |
| AI prompts and outputs | [PERIOD] |
| Consent and acceptance records | Duration of account plus [PERIOD] for legal-claims purposes |
| Backups | [BACKUP CYCLE] after deletion from active systems |
11.2 We retain information longer where required by law or reasonably necessary for the establishment, exercise, or defense of legal claims.
11.3 Time Records may be retained longer than other content where wage-and-hour, employment, or tax recordkeeping law requires it. [CONFIRM the applicable period with counsel]
These periods must match Terms of Use Section 17 exactly.
12. If Your Information Appears in Someone Else's Workspace
12.1 If you are a client, contractor, or other individual whose name or details appear in a card, comment, or attachment, your information may be held in that organization's workspace.
12.2 The organization that placed it there decides what to record and why. We process it on their behalf in that respect.
12.3 Please direct requests to access, correct, or delete that information to the organization that holds it. If you contact us, we will refer you to them, or forward your request where we are able to identify the relevant organization.
12.4 You may contact us at [PRIVACY CONTACT] if you are unable to identify or reach that organization.
13. Your Privacy Rights
13.1 Depending on where you live, you may have the right to:
- Know what personal information we collect, use, disclose, and retain about you;
- Access a copy of it in a portable format;
- Correct inaccurate personal information;
- Delete personal information, subject to legal exceptions;
- Opt out of sale or sharing — noting that we do neither;
- Limit the use of sensitive personal information, subject to Section 4.2;
- Non-discrimination for exercising any of these rights.
13.2 How to exercise them. Contact [PRIVACY CONTACT], or use the tools in your account settings where available.
13.3 A limit worth stating plainly. Some records cannot simply be deleted on request. Time Records, approval records, and audit history exist to evidence work performed and approved, and may be retained where an organization needs them for payroll, invoicing, tax, or legal-claims purposes, or where law requires it. We will explain the basis when we decline a deletion request in whole or in part.
13.4 Verification. We will verify your identity before acting, typically by confirming control of the email on the account. We will not use verification information for any other purpose.
13.5 Timing. We will acknowledge within 10 business days and respond within 45 calendar days, extendable once by a further 45 days with notice.
13.6 Authorized agents. An agent may submit a request on your behalf with written authorization; we may contact you to confirm.
13.7 No fee. Requests are free unless manifestly unfounded or excessive, in which case we will explain before proceeding.
13.8 Appeals. [CONFIRM — several state privacy laws require an appeal mechanism.]
14. Security
14.1 We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, authentication requirements, permission-based visibility, and activity logging. [CONFIRM the specific list against what is actually implemented]
14.2 No system is completely secure, and we cannot guarantee absolute security.
14.3 You are responsible for safeguarding your credentials. Report suspected compromise to [SECURITY CONTACT].
15. Where We Process Information
15.1 Thunderbolt Group, LLC operates from the United States, and personal information is stored and processed there.
15.2 Our personnel and contractors located outside the United States, including in [the Philippines / CONFIRM], may access personal information in the course of providing and supporting the service. Access is limited to what is necessary and is subject to confidentiality obligations. [CONFIRM]
15.3 AI model providers and other subprocessors may process information in [JURISDICTIONS]. [CONFIRM]
16. Children
Thunderbolt PM is a business tool not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it. Contact [PRIVACY CONTACT] if you believe a child's information has been provided.
17. Changes to This Policy
17.1 We may update this Policy. We will post the revised Policy with a new Effective Date and version number.
17.2 For material changes — including any change to how AI Features process information, to the training position in Section 7.6, or to how Time Records are used — we will provide advance notice of at least [30] days and obtain renewed acceptance before the change takes effect.
17.3 We maintain prior versions and make them available on request.
18. Contact Us
Thunderbolt Group, LLC
25568 Genesee Trail Road
Golden, CO 80401
[PRIVACY CONTACT EMAIL] · [PHONE]
Effective [DATE]