ThreadKore privacy policy

Effective date: [DATE — confirmation required]
Last updated: [DATE — confirmation required]

1. Overview

ThreadKore, LLC ("ThreadKore," "we," "us") makes a business operating system for homebuilders. This Privacy Policy explains how we collect, use, share and protect personal information when you visit www.threadkore.com (the "Site"), book a demo or contact us. It also explains the choices and rights you have.

The Site is built for businesses: homebuilders, their teams, and the trades and vendors who work with them. Most of the information we receive is business contact information, such as your name, company and work email.

This policy covers the Site only. It does not cover the ThreadKore platform that customers use under a separate agreement. Customer data in the platform is handled under that agreement. [CONFIRM: whether a separate platform privacy notice or data processing terms exist, and link them here.]

In short:

• We collect what you type into our contact form, plus basic technical information needed to run and secure the Site.
• Analytics and advertising tracking are off unless you turn them on in our privacy-choices panel.
• If you turn on advertising, Google, Meta, LinkedIn and RB2B receive information through their tags. RB2B may identify the company and business contact visiting the Site, even without a form submission. Some state laws call these disclosures a "sale" or "sharing." You can turn them off at any time, and we honor Global Privacy Control signals.
• We do not sell form submissions to data brokers or anyone else. [CONFIRM: company practices outside this website, including any disclosure of inquiry lists.]

2. Information we collect

2.1 Information you give us

When you use the contact or demo form at /contact/, we collect:

The form also includes a hidden field that people can't see. Automated spam tools tend to fill it in, so it helps us filter out spam. Please don't put confidential customer or financial information in the message box.

If you email us, call us or write to us, we collect what you choose to share, such as your name, contact details and the content of your message.

2.2 Information we collect automatically

Always, to run and protect the Site. Like any website, our servers and our hosting and security provider, Cloudflare, receive technical information when your browser requests a page. This includes your IP address, browser and device type, the page you asked for, the referring page, and the date and time. We use it to deliver pages, keep the Site secure and stop abuse. We also keep anonymous, grouped counts of request errors, missing pages, form failures and rate limits to maintain the Site. These counts contain no visitor identifiers and none of what you submit.

Only if you opt in to "Analytics and estimated location." With your permission, we record:

• Activity: page views, navigation and button clicks, scroll depth, successful request counts, and page-load and responsiveness measurements. These activity records never include form contents, names, email addresses or raw IP addresses.
• Estimated location: your network-based country, state or region, and city, as estimated by our hosting provider. We never request GPS access. We never store coordinates, street addresses or postal codes. Estimates can be wrong, especially if you use a VPN, and if no location is available, it stays unknown.
• Google Analytics: Google Analytics (measurement ID G-MM58VPCHN8) collects information about your visit, such as pages viewed, approximate location, device and browser details, and identifiers stored in cookies.

Only if you opt in to "Advertising." With your permission, we load advertising tags from Google Ads (AW-18146724072), Meta (Meta Pixel) and LinkedIn (LinkedIn Insight Tag). These tags collect information such as the pages you view, actions you take on the Site, your IP address, browser and device details, and cookie or other online identifiers. Each company may link this to an account you have with it.

The same optional category, labeled "Advertising and business visitor identification" in the panel, also enables RB2B. RB2B describes using first- and third-party cookies, device identifiers and IP addresses to associate website visits with companies and people known to its network, and using reverse-IP lookup for company identification. It may associate your visit with information it or its partners hold about you, including a name, email address, company or LinkedIn profile, even if you do not submit a form. RB2B's policy describes obtaining information from data providers, integration partners and public sources. This is third-party identification, not our own anonymous activity measurements; an analytics-only choice does not enable RB2B.

The reviewed account SDK requests an IP-based location response from pro.ip-api.com, including latitude/longitude, postal code, city, region, country, time zone, internet service provider and proxy/hosting indicators. It can store that response in _reb2bgeo and include it in its collection request. Those third-party fields are separate from the Site's own analytics/location records, which exclude coordinates and postal codes. The SDK also requests matching identifiers from a.usbrowserspeed.com, alocdn.com and a secondary script at b-code.liadm.com, and sends a collection request to its account-specific AWS API Gateway. Matching data may include hashed email identifiers and existing Meta or HubSpot cookie identifiers, if present; hashing does not make them anonymous. [CONFIRM: review secondary-script dependencies, account settings and the providers' contractual roles.]

See section 5 for the cookies and similar technologies involved.

2.3 Information from third parties

• Advertising and analytics providers. If you have opted in, Google, Meta and LinkedIn may give us reports about how our ads and Site perform. These reports are usually aggregated, meaning grouped and not tied to one person.
• Business visitor identification. With advertising permission, RB2B may provide company and business contact information about visitors, such as names, email addresses and LinkedIn profiles, matched using its network and other sources. These results can identify a person and are not necessarily aggregated or anonymous. [CONFIRM: the subscribed RB2B features, fields received, account access, integrations, retention and any follow-up process. The Site does not save these identification results in its first-party activity, performance or location tables.]
• Our hosting provider. Cloudflare provides the network-based location estimate described above.

We do not ask for sensitive personal information, such as Social Security numbers, financial account details or precise geolocation, through the Site. Please do not include it in a free-text message.

3. How we use information

We use personal information to:

• Respond to your inquiry. We schedule demos, answer questions and follow up on the request you made.
• Understand your business needs. We tailor a demo to your builder type, size and role.
• Run, maintain and secure the Site. This includes preventing spam, fraud, bots and abuse, and fixing errors.
• Measure and improve the Site (only with analytics consent). We learn which pages are useful and how the Site performs.
• Measure and personalize advertising (only with advertising consent). We see whether our ads on Google, Meta and LinkedIn work, and show relevant ads.
• Identify business visitors (only with advertising consent). RB2B may help us understand which companies and business contacts visit the Site for business-to-business sales and marketing. [CONFIRM: how the team uses identification results, including whether it sends outreach and which communications choices apply.]
• Send business communications as described in section 13.
• Meet legal obligations. We keep records, respond to lawful requests, and enforce or defend our rights.

We do not use the Site's information to make decisions that have legal or similarly significant effects on you, such as decisions about credit or employment.

4. How we share information

4.1 Service providers

We share personal information with companies that help us operate. [CONFIRM: applicable contracts, provider roles, and restrictions on their use of personal information.]

The Site saves inquiries in its own database. Automated forwarding to Cadence2Close or sending email notifications has not been configured on this website.

The Site sends a no-transform response directive to prevent automatic Cloudflare Web Analytics script injection. This suppression has been verified on the Test preview; the hosting dashboard setting remains unchanged. [CONFIRM: verify suppression on the live Site and disable Web Analytics in the Cloudflare dashboard before approving this policy.]

4.2 Analytics, advertising and business identification partners (only with your consent)

These partners receive information directly through their tags and use it under their own privacy policies. They may combine it with other information they hold about you.

RB2B's policy also describes disclosure to customers, business and data partners, and providers, and uses beyond supplying this Site's reports. Do not assume RB2B acts solely as our service provider. [CONFIRM with counsel: the applicable RB2B contract, partner roles, data uses, geographic restrictions and required disclosures before approving this policy.]

4.3 What "sale" and "sharing" mean here

Some state privacy laws define "sale" and "sharing" broadly. Under the California Consumer Privacy Act, as amended by the CPRA, "sharing" means giving personal information to a third party for cross-context behavioral advertising, which is ads based on your activity across different businesses' websites and apps, whether or not money changes hands. Several other states treat this kind of activity as a "sale" or as "targeted advertising."

When you turn on the Advertising category, the Google Ads, Meta and LinkedIn tags receive identifiers and Site activity that those companies can use for this kind of advertising. We treat this as a "sale" or "sharing" of personal information under those laws. In the past 12 months, the categories involved were identifiers (such as cookie IDs, advertising IDs and IP address) and internet activity on the Site. Those categories went only to Google, Meta and LinkedIn, and only for visitors who opted in. [CONFIRM: the full 12-month history and company-wide disclosures; current website code alone does not verify historical practices.]

Advertising permission now also enables RB2B business visitor identification. RB2B may receive online identifiers and Site activity and match those with business contact and professional information held by its network or other sources. We include this disclosure in the Advertising opt-out and treat it as a potential sale or sharing rather than assuming a service-provider exemption. [CONFIRM with counsel: the exact sale/sharing classification, categories, recipients and historical disclosures under the applicable contracts and state laws. Adding RB2B now does not establish that it received information in the prior 12 months.]

We treat Google Analytics as analytics, not advertising. [CONFIRM: that Google Signals and Google Ads linking are turned off in the GA4 property. If either is on, move Google Analytics into the "sale/sharing" description above.]

We do not sell or share form submissions (your name, company, email, phone or message) for money or for cross-context behavioral advertising. [CONFIRM: that form data is never uploaded to ad platforms, for example as Customer Match, Custom Audiences or LinkedIn Matched Audiences lists. If it is, this sentence must change.]

We do not knowingly sell or share the personal information of anyone under 16.

To opt out, see section 7.3.

4.4 Other sharing

We may also disclose personal information:

• For legal reasons: to comply with law, a court order or another legal process, or to protect the rights, property or safety of ThreadKore, our customers or others.
• In a business transfer: as part of a merger, acquisition, financing or sale of assets. The information would stay subject to this policy or to protections that are at least as strong.
• With your direction or consent: for example, if you ask us to introduce you to a ThreadKore builder reference.

5. Cookies and the privacy choices panel

5.1 How the panel works

The first time you visit without a remembered choice, "Your privacy choices" opens a full-width dialog. You can choose "Accept all optional tracking", "Essential only", or "Customize" to choose two optional categories. You can also close the dialog without granting permission. The dialog pauses interaction with the page while open, but acceptance is not required to use the Site.

• Analytics and estimated location: our own activity and location records, plus Google Analytics.
• Advertising and business visitor identification: Google Ads, Meta Pixel, LinkedIn Insight and RB2B tags. RB2B may identify your company and business contact information without a form submission.

Both are off by default. Nothing optional loads until you explicitly accept all optional tracking or turn a category on and save your choices, and the Site confirms permission. If you choose "Essential only", or don't make a choice, no analytics or advertising tags load and no analytics or advertising cookies are set. The contact form and the rest of the Site work either way. Necessary security and contact-form functions remain available.

A "Your Privacy Choices" link appears at the bottom of every page, so you can change or withdraw your permission at any time. Changing a choice may reload the page to stop tags that are already running.

When you withdraw analytics permission, we stop new activity and location tracking and ask for removal of the location estimate for your current session. Activity saved earlier stays in our reports. Location records keep their original expiration date (see section 6).

Your choice is recognized in your browser for 180 days from your explicit decision. Browsing alone does not extend that period. After that, or if you clear your browser storage or we change the tracking categories, the panel may appear again. Browser settings or private browsing may clear it earlier. These browser records contain privacy choices, not form details.

We ask visitors with an earlier opt-in to choose again when adding RB2B, because this is a material new vendor and identification use. Earlier acceptance does not authorize RB2B; earlier declines remain honored. Optional tracking stays off until the new choice is saved and confirmed.

5.2 Cookies and similar technologies we use

The first-party entries below reflect the website code checked on October 11, 2026. The third-party entries describe possible provider cookies, not a confirmed inventory of every cookie currently set. Providers can change their cookies without notice. [CONFIRM: third-party cookie names and lifetimes against the live account settings and browser behavior.]

Strictly necessary

Analytics (only with analytics consent)

Advertising (only with advertising consent)

You can also block or delete cookies in your browser settings. Cookies controlled by Google, Meta, LinkedIn and RB2B or its partners may also need to be managed through your browser or with those companies. Withdrawal stops future loading of RB2B on this Site and may reload the page to halt running tags; it does not delete information already received by RB2B. RB2B's privacy policy explains its database opt-out, access and deletion choices.

The RB2B entries above are conditional names and maximum lifetimes found in a static review of this account's main SDK, not a claim that every entry is set during every visit. Browser restrictions may shorten lifetimes. The Site removes the listed accessible RB2B cookies and local-storage entries when withdrawing permission, but cannot delete third-party-domain or inaccessible cookies. [CONFIRM: live behavior and secondary-script inventory before approving this policy.]

6. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or longer if the law requires.

7. Your US state privacy rights

7.1 Who these rights apply to

Residents of California, and of other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas, Oregon and others), have rights over their personal information. These rights apply to information collected in a business-to-business context too, including your work contact details. [CONFIRM with counsel: which state laws apply to ThreadKore. Whether to extend these rights to all US visitors as a policy choice, as this draft does in 7.2.]

7.2 Your rights

Subject to some legal exceptions, you have the right to:

• Know and access: ask what personal information we have collected about you, where it came from, why we collected it and who we disclosed it to, and get a copy.
• Correct: ask us to fix inaccurate personal information.
• Delete: ask us to delete personal information we collected from you.
• Portability: get your information in a usable format.
• Opt out of sale, sharing and targeted advertising: see 7.3.
• Limit use of sensitive personal information: we don't collect sensitive personal information through the Site, so there is nothing to limit.
• Opt out of profiling for decisions with legal or similarly significant effects: we don't do this.
• Appeal: if you live in a state that provides this right and we decline your request, you can appeal (see 8.4).

As a matter of policy, we honor these requests from any US visitor, wherever they live. [CONFIRM]

7.3 Do Not Sell or Share My Personal Information

You can opt out of the "sale" or "sharing" of your personal information, and of targeted advertising, in any of these ways:

1. Privacy choices panel: click "Your Privacy Choices" at the bottom of any page, turn off Advertising and business visitor identification and save, or click "Essential only." Advertising is off unless you turn it on.
2. Global Privacy Control (GPC): if your browser or extension sends a GPC signal, we treat it as a valid request to opt out of the sale and sharing of your personal information, and of targeted advertising, for that browser. We keep the Advertising category off, so Google Ads, Meta, LinkedIn and RB2B tags do not load, and the panel shows that your GPC signal was honored. If GPC conflicts with an earlier choice to turn advertising on, GPC wins in that browser. To learn more, visit globalprivacycontrol.org.
3. Email or phone: contact us using section 8. We will apply the opt-out to any information tied to you that we can identify.

Our site also keeps optional analytics off when a GPC or Do Not Track preference is active.

Opt-outs set in the panel or by GPC apply to the browser and device you use. If you use another browser or device, or clear your browser storage, set your choice again.

7.4 California disclosures (past 12 months)

We do not ask for sensitive personal information as defined by California law. We do not offer financial incentives for personal information. [CONFIRM with counsel: this statement and the California disclosure table, including company-wide practices.]

The table includes the newly added RB2B integration as a current disclosure, not a verified statement that RB2B received data throughout the prior 12 months. [CONFIRM: update the historical table to reflect actual practices before publication.]

8. How to submit a request and how we verify it

8.1 How to submit a request

• Email: support@threadkore.com
• Phone (toll-free): 855-954-KORE (855-954-5673)
• Mail: ThreadKore, LLC, Attn: Privacy, 2520 Northwinds Parkway, Suite 300, Alpharetta, GA 30009

Please tell us what you are asking for, your name, and the email address or other details you used with us.

8.2 How we verify your identity

To protect your information, we need to confirm a request comes from you before we act on it. We will:

• Match the details you give us against the information we hold. Usually this means confirming your email address by sending you a message there.
• Ask for more information only if needed. For requests for specific pieces of information or for deletion, that may include more details that match our records.
• Use any information you give us for verification only for that purpose.

You don't need to verify your identity to opt out of sale or sharing.

Our first-party activity records generally cannot be linked by us to a named person, but RB2B identification results may contain named business contacts. If we can't verify that particular data belongs to you, we will tell you, and you can still use the privacy choices panel or GPC to control future tracking. [CONFIRM: the team's access to and verification process for RB2B records.]

8.3 Response timing

We will confirm that we received your request within 10 business days and respond within 45 days. If we need more time, we may extend this by up to another 45 days as the law allows, and we will tell you why. We will act on opt-out requests as soon as possible, and within 15 business days. [CONFIRM with counsel and the team: these proposed response periods, which laws apply, and the operational process to meet them. They are not verified response commitments in this draft.]

8.4 Appeals

If we decline your request, in whole or in part, we will explain why. If your state provides a right to appeal, you can appeal by replying to our decision or emailing support@threadkore.com with "Privacy Appeal" in the subject line. We will respond to appeals within the time required by your state's law. If you are not satisfied, you may contact your state attorney general.

9. Authorized agents

You can use an authorized agent to make a request for you. We will ask the agent for proof that you gave them permission, such as written permission you signed, or a valid power of attorney. Unless the agent has a power of attorney, we may also ask you to verify your identity directly with us or confirm that you authorized the agent. We may deny a request from an agent who can't provide proof.

10. Non-discrimination

We will not discriminate against you for exercising your privacy rights. We won't deny you our services, charge you a different price or give you a lower quality of service because you made a request. Choosing not to allow analytics or advertising has no effect on the contact form or any other part of the Site.

11. Security

We use reasonable administrative, technical and physical safeguards designed to protect personal information. These include encrypted (HTTPS) connections to the Site, Cloudflare's security and bot-protection services, spam filtering on our forms, and limits on who can access inquiry data. [CONFIRM: describe internal access controls accurately, for example who can see form submissions and whether multi-factor authentication is used on the systems that store them.]

No website or system is completely secure, and we can't guarantee the security of information sent to us online. If you think your information has been put at risk, contact us right away.

12. Children's privacy

The Site is a business-to-business website. It is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child under 16 has given us personal information, contact us and we will review the request and take appropriate steps to delete it. We do not operate a parental-verification system.

13. Marketing communications and unsubscribing

When you submit the contact form, you agree that ThreadKore may contact you about your inquiry. We will use your details to respond, set up a demo and follow up on that conversation.

[CONFIRM, choose one:]

• [Option A: no marketing list.] We do not add people who fill out the form to marketing email lists.
• [Option B: B2B marketing email.] We may also send you occasional emails about ThreadKore products, events and updates that relate to your business. [If you add a separate optional marketing checkbox, say: "only if you check the box to receive them."]

Every marketing email we send includes our mailing address and an unsubscribe link. You can also unsubscribe by emailing support@threadkore.com. We will process unsubscribe requests within 10 business days. Even if you unsubscribe, we may still send you messages about an active conversation or a business relationship with us. [CONFIRM: marketing option, email practices, unsubscribe handling, and the team's response process. The inquiry checkbox is not automated marketing permission.]

Phone and text: your phone number is optional. We will only call you about your inquiry. We will not send marketing text messages, or make autodialed or prerecorded marketing calls, unless you give separate written consent.

14. International visitors

ThreadKore is based in the United States, and the Site is intended for businesses in the United States. [CONFIRM: whether you market to Canada or other countries.] If you visit from outside the US, your information will be processed and stored in the United States and in other countries where our service providers operate. Data protection laws there may differ from those where you live. By using the Site, you understand that your information will be handled in this way. [CONFIRM with counsel if you actively market to the EU, UK or Canada, because additional terms would be needed.]

15. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date at the top. If we make material changes, such as using personal information in a significantly new way, we will give more prominent notice, such as a notice on the Site or a new privacy choices prompt. We will ask for your consent where the law requires it.

16. Contact us

ThreadKore, LLC
Attn: Privacy
2520 Northwinds Parkway, Suite 300
Alpharetta, GA 30009
Phone: 855-954-KORE (855-954-5673)
Email: support@threadkore.com
Website: www.threadkore.com