Throughpoint sits close to sensitive work — your meetings, decisions and engineering tools. This policy explains exactly what we touch, how long we keep it, and the control you have over all of it.
Throughpoint (“Throughpoint,” “we, ” “us,” or “our”) provides a reconciliation layer for engineering teams. We read what your team decides in meetings and across your tools, detect when those things drift apart, and propose a fix as a card in your chat tool that a person approves before anything is written back.
This Privacy Policy explains what personal data we collect, why, how we use and share it, how long we keep it, and the rights you have over it. It applies to our website, the Throughpoint dashboard, our chat apps, and the integrations that connect Throughpoint to your engineering tools (together, the “Service”).
Roles under the UK GDPR / EU GDPR: for data about your team’s meetings, decisions and connected tools, your organisation is the controller and Throughpoint is a processor acting on your instructions. For our website and account administration, Throughpoint is the controller. See Legal bases for detail.
This policy covers personal data processed when you or your organisation:
It does not cover the third-party services you connect Throughpoint to (for example Linear, Jira, ClickUp, GitHub, Slack, Microsoft Teams, Google Calendar or Google Meet). Those services have their own privacy policies.
We collect only what the Service needs to do its job.
We don’t keep recordings. Once a meeting’s transcript is stored, we instruct our meeting-bot provider to delete the recording. Transcripts are then kept only for your team’s retention window. See Data retention.
When you authorise an integration, we read the data needed to detect drift and carry out the changes you approve:
We store the access tokens for each connection in an encrypted token vault. We never receive or store your passwords for these services.
Your plan, seat count and billing history. Card details are collected and held by our payment processors (Stripe or Paystack); we keep only the reference they give us to charge your saved card, encrypted in the token vault.
We use personal data for the following purposes, and no others:
Throughpoint uses third-party AI providers to extract decisions, link related decisions across meetings and draft cards. We send content to them under terms that prohibit using it to train their models.
No solely-automated decisions with legal or similarly significant effects. Throughpoint only ever proposes. A person on your team approves or dismisses every change before it lands.
These are the vendors that process personal data on our behalf:
Each subprocessor is bound by a data-processing agreement and may only process data on our documented instructions. Questions about a specific vendor: [email protected].
Where the UK GDPR or EU GDPR applies and Throughpoint is the controller, we rely on the following legal bases:
Where your organisation is the controller (your meeting and tool data), we process it as a processor strictly on your organisation’s instructions under our customer agreement and data-processing terms.
A daily job deletes data once it is older than the windows below. Your team’s admins can see and change the windows in Settings → Security.
When your organisation asks us to delete its team, we delete, in one operation: meetings, transcripts, topic summaries, decisions and the links between them, cards and the AI assessments behind them, your ticket and sprint snapshot, every tool, calendar, code-host and chat connection along with the encrypted tokens and saved-card reference in our token vault, billing records, invites, team memberships, team member records and the audit log. Your personal sign-in account is unlinked from the team and kept only if you belong to another team; ask us and we will delete it too. Residual copies in encrypted backups age out on our standard backup cycle.
We apply technical and organisational measures appropriate to the sensitivity of the data:
No system is perfectly secure, but we work to protect your data and will notify you and any relevant regulator of a personal-data breach where the law requires it.
We and our subprocessors may process data in the United Kingdom, the European Economic Area, the United States and other countries where they operate.
Where we transfer personal data outside the UK or EEA, we rely on a lawful transfer mechanism — such as an adequacy decision, the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses — together with additional safeguards where needed.
Depending on where you live, you may have some or all of the following rights over your personal data:
To exercise any of these, email [email protected]. We will respond within the timeframe required by law (generally one month under the GDPR). If your data is controlled by your organisation, we may refer your request to them and assist as their processor.
You also have the right to lodge a complaint with a supervisory authority. In the UK that is the Information Commissioner’s Office (ICO). We’d appreciate the chance to address your concern first.
Throughpoint is a workplace tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.
We may update this Privacy Policy as the Service evolves or the law changes. When we make material changes, we will update the “Last updated” date above and notify your team’s admins by email or in the dashboard. We will give admins at least 30 days’ notice before adding a new subprocessor.
Continuing to use the Service after an update takes effect means you accept the revised policy.