Note: This document is provided as a working template and should be reviewed by qualified legal counsel before being relied upon for compliance or enforcement purposes.
Your privacy matters to us. This Policy explains what information Umbrella Projects, Inc. (d/b/a Multithred) collects when you use Multithred and how we use and protect it.
1. Introduction and Scope
This Privacy Policy describes how Umbrella Projects, Inc. (“we,” “us,” or “our”), doing business as Multithred, collects, uses, and protects information when you use our website at multithred.com, our application at app.multithred.com, and related services (collectively, the “Service”).
This Policy applies to visitors, account holders, and authorized users of customer workspaces. It does not cover third-party websites or services (including Reddit and Stripe), which are governed by their own privacy policies.
2. Information We Collect
We collect the following categories of information:
Account and contact information. Name, email address, workspace and role assignments, and communications you send to us (e.g., support requests sent through our contact page).
Reddit authorization data. When you connect a Reddit account, we receive OAuth tokens and associated metadata (such as Reddit username and account identifiers) within the scopes you approve. We access Reddit advertising and content data only as authorized by you.
Advertising and discussion content. Campaign, ad group, and ad data from the Reddit Ads API; post and comment content from threads on your promoted posts; metrics and performance reports; and discussion-quality scores computed by the Service.
Knowledge base content. Information you upload or we extract from URLs you provide (e.g., product descriptions, FAQs) to power on-brand reply drafting.
Usage and technical data. Log data, IP address, browser type, device information, pages viewed, and feature usage necessary to operate and secure the Service.
Billing information. Subscription plan, payment status, and invoice records. Payment card details are collected and processed directly by Stripe; we do not store full card numbers on our servers.
Cookies and analytics. On the marketing website, we may use cookies and similar technologies via Google Tag Manager and Google Analytics to understand site traffic and CTA performance. See Section 6 for details.
3. How We Use Information
We use collected information to:
- Provide, operate, and maintain the Service
- Authenticate users and manage workspace access
- Create, manage, and report on Reddit advertising campaigns on your behalf
- Monitor comment threads and classify incoming comments
- Generate AI-assisted drafts of replies and ad concepts for your review
- Process subscriptions and payments through Stripe
- Send transactional emails (magic links, billing notices, service alerts) via AWS SES
- Improve the Service, troubleshoot issues, and ensure security
- Comply with legal obligations and enforce our Terms of Service
We process information based on performance of our contract with you, our legitimate interests in operating and improving the Service, and compliance with legal obligations. Where required, we obtain your consent (e.g., for optional analytics cookies).
4. Reddit Data
Multithred accesses Reddit data only through OAuth authorization you explicitly grant. We do not scrape Reddit, access data without consent, or collect data from accounts you have not connected.
Reddit content (posts, comments, and related metadata) is used solely to provide the Service — including monitoring discussions on your promoted posts, drafting replies for your review, and reporting metrics. We do not use Reddit data to build advertising audiences or for targeting outside the Reddit Ads API.
Reddit data is processed by AI models for inference only (classification, summarization, and drafting at the time of request). We do not use Reddit data to train machine learning or AI models, consistent with Reddit’s developer policies.
Each connected Reddit account’s OAuth refresh token is stored encrypted at rest. You may revoke Multithred’s access at any time through Reddit’s connected-apps settings.
5. Subprocessors and Service Providers
We share information with trusted service providers who process data on our behalf, subject to contractual obligations to protect your information:
| Provider | Purpose | Location |
|---|---|---|
| Ads API, Data API, OAuth | United States | |
| OpenAI | AI generation, classification, embeddings | United States |
| Stripe | Payment processing and billing | United States |
| Amazon Web Services (AWS) | Cloud hosting, email (SES), infrastructure | us-east-1 (United States) |
We may also disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).
7. We Do Not Sell Your Data
We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share data only as described in this Policy — with service providers who assist in operating the Service, when you direct us to (e.g., posting to Reddit on your behalf), or when required by law.
8. Data Retention and Deletion
We retain information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.
Reddit-sourced content is subject to automated retention enforcement: aged Reddit content is tombstoned or pruned on a scheduled basis in accordance with our data lifecycle policy. Operational logs and transient job data are pruned according to defined retention windows.
Upon account termination or a verified deletion request, we will delete or anonymize your personal information within a reasonable period, except where retention is required by law or for legitimate business purposes (e.g., billing records).
To request deletion, contact us via our contact page.
9. Security
We implement technical and organizational measures designed to protect your information, including:
- Encryption of OAuth tokens and sensitive credentials at rest
- TLS encryption for data in transit
- Role-based access controls within customer workspaces
- Hashed, single-use magic link tokens for authentication
- Infrastructure hosted on AWS with restricted network access
No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately via our contact page.
10. Your Rights
Depending on your location, you may have rights regarding your personal information, including the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your information
- Object to or restrict certain processing
- Data portability (receive a copy in a structured format)
- Withdraw consent where processing is consent-based
California residents may have additional rights under the CCPA/CPRA, including the right to know what personal information is collected and the right to opt out of sale (we do not sell personal information). EEA/UK residents may lodge a complaint with a supervisory authority.
To exercise your rights, contact us via our contact page. We will respond within the timeframe required by applicable law.
11. International Transfers
We are based in the United States and process information on servers located in AWS us-east-1. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.
Where required, we implement appropriate safeguards for international data transfers.
12. Children
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it promptly. Contact us via our contact page if you believe we have inadvertently collected such information.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised Policy on this page and update the “Effective date” above. Material changes will be communicated via email or in-product notice where practicable.
Your continued use of the Service after changes become effective constitutes acceptance of the updated Policy.
14. Contact Us
Privacy questions or requests may be directed to:
Umbrella Projects, Inc.
d/b/a Multithred
Contact: our contact page