Privacy Policy

Introduction

Thursti ("we," "our," or "us") operates the website www.thursti.com, the Thursti mobile and TV applications, and related digital signage services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Password (stored securely using industry-standard hashing)
• Business or venue name (optional)

Beer Menu Data

When you use our AI beer menu features, we collect:

• Beer names, styles, ABV, IBU, tasting notes, and other details you provide
• Menu configurations and display preferences
• Photos of menus or tap lists uploaded for AI processing

Device and Usage Information

We automatically collect certain information when you access the Service:

• Device type, operating system, and screen resolution
• Browser type and version
• IP address and approximate location (city/region level)
• Pages visited and features used
• Date and time of access

Android TV / Google TV App

Our Android TV application is a WebView-based digital signage player. It collects:

• Device screen resolution (to optimize display output)
• Network connectivity status (to manage offline behavior)
• No personal data is stored locally on the device beyond standard WebView cache

How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service
• Process and display your beer menus on digital signage screens
• Power AI-generated beer descriptions and menu formatting
• Send important service notifications (e.g., account verification, password resets)
• Improve and optimize the Service
• Respond to your inquiries and support requests
• Detect and prevent fraud or abuse

AI-Powered Features

Thursti uses artificial intelligence (including third-party AI services) to generate beer descriptions, parse menu photos, and suggest beer information. When you use these features:

• Data you provide (beer names, photos, etc.) may be sent to third-party AI providers for processing
• We do not use your data to train AI models
• AI-generated content is provided for informational and display purposes and may not always be perfectly accurate

Information Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

• Service providers: We use third-party services for hosting, AI processing, email delivery, and analytics. These providers access data only as needed to perform their functions.
• Public display: Beer menu content you create is intended to be displayed publicly on digital signage screens. This is the core function of the Service.
• Legal requirements: We may disclose information if required by law, regulation, or legal process.
• Business transfers: In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of that transaction.

Data Security

We implement reasonable security measures to protect your information, including:

• HTTPS encryption for all data in transit
• Secure password hashing
• Access controls limiting who can view user data

However, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

Data Retention

We retain your account information for as long as your account is active. You may request deletion of your account and associated data by contacting us at hello@thursti.com. Some data may be retained as required by law or for legitimate business purposes.

Cookies and Tracking

We use a small number of strictly-necessary cookies to:

• Keep you signed in to your account
• Remember your preferences and settings

You can control cookie settings through your browser. Disabling these cookies may affect your ability to sign in or use parts of the Service.

Our Own Marketing Page Counter (No Cookies, No Tracking IDs)

On our public marketing pages (such as our homepage and the Craft Beer Database) we count basic, anonymous traffic so we can tell whether our outreach is working. This first-party counter does not set cookies or other persistent identifiers.

This section describes only our own counter. Those marketing pages also load third-party marketing tools (HubSpot, Google Ads and Google Analytics) which do set cookies once you accept them — see Third-Party Marketing and Advertising Cookies below.

For each marketing pageview, our own counter records:

• The page that was viewed (e.g. /)
• The host name of the referring site, if any (e.g. google.com)
• UTM campaign parameters in the URL (utm_source, utm_medium, utm_campaign, utm_content, utm_term) so we can see which campaigns drive traffic
• An anonymous, daily-rotating, salted hash derived server-side from a truncated IP address and your browser's User-Agent string. This hash lets us count "unique visits" within a single day, cannot be reversed, and cannot be linked across days.

Through this counter we do not store your IP address, your full User-Agent string, your full referrer URL, any persistent identifier, any device fingerprint, or any information that would allow us to identify you or build a profile of your activity.

Third-Party Marketing and Advertising Cookies

Our public marketing pages (homepage, landing pages, the Craft Beer Database and this privacy page) load third-party marketing tools. These are not loaded on the signed-in app, the mobile web app, the admin console, the TV player, or the screen-pairing page.

• HubSpot (our CRM and marketing platform) sets cookies including __hstc, hubspotutk, __hssc and __hssrc. __hstc and hubspotutk are persistent identifiers that last about 6 months and let HubSpot recognize a returning visitor, link a form submission to earlier visits, and report on which pages a visitor viewed. See HubSpot's privacy policy.
• Google Ads conversion tracking (gtag.js) may set advertising cookies used to measure ad conversions. See Google's privacy policy.
• Google Analytics 4 (gtag.js, cookies _ga and _ga_*) measures how visitors find and move through our marketing pages. These are persistent identifiers lasting up to about 2 years. IP addresses are anonymized. See Google's privacy policy.

These are non-essential marketing cookies that create persistent identifiers. Unlike our own counter described above, they can be used to recognize you across visits. Blocking them does not affect your ability to use the Service.

Measuring signups and product milestones. When you accept cookies, we store a first-party cookie named thursti_attr (about 90 days) on our marketing pages. It holds the Google Analytics client identifier and any campaign parameters (gclid, utm_*) from the link you arrived on. Links on our marketing pages may also carry a short label (for example ?src=hero) that only says which button you clicked. When you open the sign-up form, create an account, pair your first screen, create your first playlist or beer menu, or upgrade to a paid plan, our server reports that event to Google Analytics together with these identifiers and an internal numeric account ID (never your name or email address), so we can tell which campaigns and pages lead to customers who actually use Thursti. We do this from our server because our signed-in app does not load any third-party marketing scripts. If you decline cookies, this cookie is never written and these events are reported without any identifier that could be linked back to you.

How we ask for your consent. We show a cookie banner on our marketing pages. We use Google Consent Mode v2, which means Google's tags are loaded in a restricted state and are not permitted to write advertising or analytics cookies until you choose “Accept”. HubSpot is not loaded into the page at all until you accept. If you choose “Decline”, these tools stay disabled and we fall back to our own cookie-free counter only. Your choice is remembered in your browser's local storage for about 6 months; you can change it at any time by clearing that stored choice or by contacting us.

Visitors in the EU/UK and other consent-required regions: because these tools set persistent identifiers, they require opt-in consent under GDPR/ePrivacy, and they are covered by “sharing” / opt-out rights under laws such as the CCPA/CPRA. For visitors in the EEA, the UK and Switzerland our tags default to denied for advertising and analytics storage until you explicitly accept. If you believe your choice has not been honored, contact us at hello@thursti.com and we will resolve it.

Third-Party Services

The Service may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it.

Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Object to or restrict certain processing of your information
• Data portability (receive your data in a structured format)

To exercise any of these rights, please contact us at hello@thursti.com.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.