Arconetix LLC uses the third parties below to run Thredo. Each one has access only to the data its role requires. This page is the complete list, and the privacy policy refers to it rather than repeating it, so there is only ever one version to keep accurate.
For the messages your customers send you, you are the data controller and Thredo is your processor. The parties on this page are therefore your subprocessors. For your own account and billing data, Arconetix is the controller.
Used for every workspace, always.
| Subprocessor | Purpose | Location |
|---|---|---|
| MongoDB, Inc. (Atlas) | Primary database — accounts, agent configuration, conversations, contacts and billing records. Encrypted at rest. | USA (AWS US-East) |
| Render, Inc. | Application hosting — runs the Thredo backend API and the web app. | USA (AWS US-East) |
| Cloudflare, Inc. | DNS and edge network for thredo.ai, and R2 object storage for files and media your customers or your team upload. | USA / global |
| Resend, Inc. | Email — sign-in links, team invitations, lead notifications and system alerts, and the checkout reminder emails a store turns on, to shoppers who subscribed to its emails. | USA |
| Stripe, Inc. | Payment processing for subscriptions. Full card data goes directly to Stripe and never touches Thredo servers. | USA |
| Hostinger International Ltd. | Domain registrar for thredo.ai and arconetix.com. No customer data. | Lithuania / EU |
| Ahrefs Pte. Ltd. | Traffic analytics for the thredo.ai marketing site only — page views and referrers, cookieless. It does not run on app.thredo.ai and never sees an account, a conversation or a contact. | Singapore |
Every AI reply is generated through OpenRouter, which routes the request to the model vendor your workspace has selected. What is sent is your saved system prompt, your agent's knowledge base, and the recent conversation context — not your whole message history.
| Subprocessor | Purpose | Location |
|---|---|---|
| OpenRouter, Inc. | Routes every AI request to the selected model vendor. Requests are sent with data collection denied, which excludes any upstream provider that trains on prompts. | USA |
| OpenAI, OpCo, LLC | GPT models, when selected. Also receives voice notes directly, outside OpenRouter, for speech-to-text transcription when a customer sends audio. | USA |
| Anthropic PBC | Claude models, when selected. | USA |
| Google LLC | Gemini models, when selected. | USA |
| xAI Corp. | Grok models, when selected. | USA |
A model vendor other than OpenAI receives data only if a workspace selects one of its models. OpenAI is listed separately from the routing because voice-note transcription reaches it directly rather than through OpenRouter.
Your data is not used to train models. This holds for two different reasons and both matter: OpenRouter requests deny data collection, which excludes providers that train on prompts, and OpenAI's API terms exclude API traffic from training by default.
Each applies only if you connect that channel.
| Subprocessor | Purpose | Location |
|---|---|---|
| Meta Platforms, Inc. | WhatsApp Cloud API, Instagram Messaging and Messenger — carries inbound and outbound messages between Thredo and your customers. | USA / global |
| Telegram FZ-LLC | Telegram Bot API — carries messages for a connected Telegram bot. | UAE / global |
| Twilio Inc. | SMS and voice calls, where those channels are enabled on your workspace. | USA |
Web chat runs on Thredo's own infrastructure. A visitor using the website widget reaches Cloudflare and Render directly, and no messaging subprocessor is involved.
Reached only when the feature that uses them runs.
| Subprocessor | Purpose | Location |
|---|---|---|
| Mendable AI, Inc. (Firecrawl) | Reads your public website when you import it as agent knowledge. Public pages only; no customer data is sent. | USA |
| Tavily | Web search, when the web-search ability is enabled on an agent. The search query is sent; the conversation is not. | USA |
| DataForSEO | Search-result data used when building an agent's knowledge from your web presence. No customer data. | USA / EU |
| Google LLC | Places API for business-detail lookup during onboarding, and Google Fonts on this website. | USA / global |
| Cloudinary Ltd. | Hosts images attached to support requests. | USA / Israel |
When you connect your own Shopify store, CRM or calendar, Thredo reads and writes data in your system on your instruction. Those providers are not our subprocessors — they are systems you already have a relationship with, and your agreement with them governs that data. We list them so the picture is complete:
- Shopify Inc. — order lookup for your store. Thredo sends the order number a shopper typed and the email they gave to verify it, and receives order status back. Reads of your customers' data are recorded in an access log we keep for 90 days. If you turn on order messages or cart reminders, Thredo also reads the shopper's name, phone, email and email subscription for those orders and checkouts.
- HubSpot, Salesforce, Pipedrive, Zoho, Mailchimp, ClickUp, GoHighLevel — CRM and marketing integrations you authorise.
- Google Calendar — appointment booking, where you have connected a calendar.
Disconnecting an integration stops the flow immediately. Deleting an agent unlinks its connected stores rather than uninstalling the app from them, so revoking access on the provider's side is a separate step you control.
We will publish a new subprocessor on this page 30 days before it begins processing data, so you have time to object. To be told when this page changes, email admin@arconetix.com and ask to be added to the subprocessor notice list.
We do not sell personal information to advertisers, data brokers, or any other party.
Arconetix LLCAttn: Privacy
30 N Gould St, STE R
Sheridan, WY 82801, USA
Email: admin@arconetix.com
Phone: +1 (307) 441-9833