Privacy Policy

We collect the information you give us when you create an account and use the Service, including:

• Account and profile details: your name, email address, phone number, company or brokerage, license number, headshot, and password credentials.
• Content you upload: photos and other media in your library, and the emails and blog posts you create.
• Contacts and leads: the people you import or who reach you through your forms, including their names, email addresses, phone numbers, messages and the notes you keep on them.
• Communications you configure: the email templates, auto-replies, welcomes and drip sequences you set up to send to your contacts.
• Plan status: whether your workspace is active or paused, as reported by our reseller Altitude Mountain Scaling, which handles all billing. Themis does not collect or store payment card details.
• Support requests and correspondence you send us.

The Service works with the website you already own. When you connect a site with a publishable API key, we collect and store what is needed to serve it: the domains you allowlist, and the form submissions and inquiries visitors send from your pages.

If you choose to connect bank or card accounts, we use Plaid Inc. to do so. You sign in to your financial institution through Plaid’s interface; we never see or store your bank username or password. Plaid provides us with account names, the last four digits of account numbers, balances, and transaction history (dates, descriptions, amounts and categories), which we use only to show you your own income and expenses. This information is visible only to you (not to teammates on a shared workspace), is never sent to our AI provider, and is never used to move money.

Plaid’s handling of your information is governed by the Plaid End User Privacy Policy (plaid.com/legal). You can disconnect an account at any time from the Money page, which revokes our access through Plaid and deletes the accounts and transactions we stored; deleting your account does the same.

As you use the Service, we automatically collect usage and log data: pages viewed, features used, actions taken, approximate location derived from IP address, and device and browser information. We use a small number of first-party cookies, described under “Cookies” below.

We use information to operate, secure and improve the Service, specifically to:

• Provide the Service: power your website through our API, generate email and blog drafts, organize your leads and clients, and run the follow-up you configure.
• Send the emails you configure to the contacts you designate, and send you service and account notifications.
• Open or pause your workspace according to your plan with Altitude Mountain Scaling, and prevent fraud.
• Provide support, understand how the Service is used, and develop new features.
• Comply with law and enforce our Terms of Service.

AI features are optional and off until you explicitly allow sharing with Anthropic (Claude) in Account & security → AI privacy. For email, sequence and blog drafting, we send your instructions, draft text, profile name, business, title, bio and business type. If you choose a personalized email, we also send the selected contact’s name, inquiry and property reference. Content ideas use analyzed social posts, captions and transcripts and may run automatically after a scan while permission is enabled. Only share information you are authorized to provide. You can turn off AI sharing at any time in Account & security or at themis.altitudemountainscaling.com/account. This stops future requests, including automatic idea generation, but does not recall content already sent. The provider processes your content to return a result under business terms that restrict use of your content to providing the service. We do not sell your content, and AI output is generated for you to review before you send or publish it.

We do not sell your personal information, and we do not use it for cross-context behavioral advertising. We share information only as follows:

• Service providers (subprocessors) who host and power the Service. These currently include Supabase (database, authentication and file storage), Vercel (application hosting, United States), Plaid (bank account connections you choose to make), Resend (email delivery), Anthropic (AI), and a RapidAPI data provider (property lookups). This list may change as our vendors evolve.
• Legal and safety: when required by law, subpoena or to protect the rights, safety and property of Themis, our users or others.
• Business transfers: in connection with a merger, acquisition or sale of assets, subject to this Policy.
• With your consent, or at your direction.

Themis RE (“Themis”) operates the text messaging described here. Where you or your contacts opt in to receive text messages, we collect and store the phone number, the opt-in itself (including the consent language shown, a timestamp, and the submitting IP address), message content, and delivery status, and we honor opt-outs (such as a STOP reply) immediately.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding the aggregators and providers of the text-message services necessary to deliver the messages.

themis.altitudemountainscaling.com sets only its own (first-party) cookies, plus a few small notes kept in your browser’s storage. Each one, what it does and how long it stays:

• Sign-in cookies (“sb-…-auth-token”, sometimes split into “.0” and “.1”). Set by our sign-in provider, Supabase, on our own domain when you sign in to the Themis app. They keep you signed in and protect your account. Strictly necessary. They stay up to 400 days and are removed when you sign out.
• Visit source (“visit_source”). The first time you visit themis.altitudemountainscaling.com, including a sign-in or home-value page that a business using Themis hosts with us, we note how you found us: the page you landed on, the website that linked you (for example google.com), and any campaign tags in the link (the “utm” labels on an ad or email). If you then send a message or fill in a form here, that note goes with it, so we, or the business whose form you filled in, can tell which ads and links work. First-party, 90 days. A new tagged link replaces it; ordinary return visits leave it alone.
• Site password (“themis_gate”). Only while parts of themis.altitudemountainscaling.com are behind a preview password: remembers that you entered it so you are not asked again. First-party, 30 days.
• Mailbox and Instagram connection checks (“themis_mail_oauth_state”, “themis_meta_oauth_state”). Only inside the app, while you connect Gmail, Outlook or Instagram: a one-time code that proves the reply came back to you. First-party, 10 minutes, deleted as soon as the connection finishes.
• Your cookie choice (“cookie-consent”, browser storage). Remembers whether you pressed Accept or Decline on our cookie notice, so it does not ask again. Kept 12 months, then we ask again.
• Opening animation (“themis-intro”, browser storage). Remembers that you already saw the home page’s opening animation in this tab. Cleared when you close the tab.
• App notifications (“themis.apns.token…”, browser storage). Only in the Themis iPhone and Mac apps: remembers which device we last registered for notifications. Kept on that device until you remove the app.

We do not use advertising cookies, analytics services, tracking pixels or any third-party tracking cookies, and we never sell what these cookies hold or use it for advertising. Pressing Decline on our cookie notice keeps it that way; if we ever add an analytics or advertising tool, it will load only for visitors who pressed Accept. We treat a Global Privacy Control signal from your browser as Decline.

Two services set their own cookies on their own pages, only when you use them: Stripe, when you pay for a plan on its checkout page, and Plaid, when you choose to connect a bank or card account in the app. Their cookies are covered by their own privacy policies.

To change your choice, use “Cookie settings” at the bottom of any page on themis.altitudemountainscaling.com. You can also block or delete cookies in your browser’s settings (in most browsers, under Privacy or Site data). Blocking the visit source cookie changes nothing about how the site works. Blocking sign-in cookies means you will not be able to sign in to the app.

We keep personal information for as long as your account is active and as needed to provide the Service, then for a reasonable period afterward to comply with legal obligations, resolve disputes and enforce our agreements. You can delete content and contacts at any time, and you can delete your account from Settings; deletion requests are honored as described below, subject to backups that expire on a rolling basis.

We use administrative, technical and organizational safeguards designed to protect your information, including encryption in transit, access controls and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password confidential and notify us of any suspected unauthorized access.

Colorado residents have rights under the Colorado Privacy Act, and residents of other U.S. states may have similar rights under their own laws. Subject to those laws, you may:

• Access and confirm whether we process your personal data, and obtain a portable copy.
• Correct inaccuracies in your personal data.
• Delete your personal data.
• Opt out of the sale of personal data, targeted advertising, and certain profiling. Note that we do not engage in these activities.

To exercise these rights, email us at hello@altitudemountainscaling.com. We will verify your request and respond within the time required by law. You may use an authorized agent. If we decline your request, you may appeal by replying to our decision; if you have concerns about our appeal response, you may contact the Colorado Attorney General.

If you submitted an inquiry to a business that uses Themis, that business is the controller of your information. We process it on their behalf, so please direct access and deletion requests to them, and we will assist them in responding.

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

The Service is operated in the United States and our infrastructure is hosted in the United States. If you access the Service from outside the United States, you understand that your information will be processed here, where data protection laws may differ from those in your location.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you in the Service or by email. Your continued use of the Service after an update means you accept the revised Policy.