Privacy Policy
Effective date: To be set upon legal review · Last updated: February 2026
This policy describes how Thuja LLC, a New Jersey limited liability company ("Thuja", "we", "us"), collects and handles your data when you use our decision-intelligence platform, which is currently in private beta. It should be read together with our Terms of Service.
1. What we collect
- Account data. Your email, full name, company, and onboarding answers (expected number of users, decision-maker status, use cases), collected when you sign up.
- Customer content. The source files and data you upload or connect — documents, survey exports, transcripts — and everything derived from them: evidence, insights, claims, recommendations, and decision briefs.
- Usage data. Usage events, synthesis runs, and plan and quota counters.
- Billing data. Your subscription status and plan, held against a Stripe customer ID. Thuja never receives or stores card numbers — Stripe handles payment details directly.
2. How we use your data
- to provide the service: processing your sources, extracting evidence, and generating decision briefs;
- to create and secure your account and authenticate you;
- to operate billing and enforce plan limits;
- to send transactional email (such as sign-in links and account notices) and, subject to your ability to unsubscribe, lifecycle and marketing email;
- to understand usage and improve the product;
- to comply with legal obligations.
3. Legal basis for processing
Where such requirements apply, we process your data: to perform our contract with you (providing the service you signed up for); for our legitimate interests (securing, operating, and improving the service); with your consent, where we ask for it; and to comply with legal obligations.
4. AI model processing of your content
Content you upload to Thuja is transmitted to Anthropic, a third-party AI model provider, for processing. Thuja uses Anthropic's Claude models to classify your sources and synthesize decision briefs. This means your customer content — the documents, exports, and transcripts you upload — is sent to Anthropic's systems as part of providing the service.
This processing is what powers evidence extraction and brief generation; it is not optional within the current product. Anthropic is listed as a sub-processor below.
5. Sub-processors
We use the following providers to operate the service. Each processes data on our behalf for the purpose listed.
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, file storage, and edge functions — our primary data store |
| Vercel | Application hosting and CDN |
| Anthropic | LLM processing (Claude): source classification and brief synthesis. Customer content is sent here. |
| Stripe | Subscription billing and payment processing |
| Brevo | Marketing and lifecycle email |
| Resend | Transactional email |
| Cloudflare | Turnstile bot protection on signup |
6. Cookies and session storage
We use cookies to keep you signed in. Sessions are managed by Supabase Auth, which stores authentication tokens in cookies so the application can recognize you across requests. Cloudflare Turnstile may set cookies or use similar techniques on the signup page to distinguish people from bots.
7. Security
Authentication is by email and password or magic link, with Cloudflare Turnstile protecting signup against automated abuse. Sessions are handled by Supabase Auth. Data is stored with the providers listed above, and access to production systems is limited to those who need it to operate the service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Data retention
We retain your data for the life of your account and for a period afterward. Specific retention details are available on request at hello@jointhuja.com.
9. Your rights and how to exercise them
Depending on where you live, you may have rights over your personal data — including the right to access it, correct it, receive a copy of it, or have it deleted, and the right to object to or restrict certain processing.
To exercise any of these rights, including requesting deletion of your account and data, email hello@jointhuja.com from the address associated with your account. We will verify the request and respond. Account deletion is currently handled as a request by email rather than a self-serve control in the product.
10. Children's privacy
The service is not directed to, or intended for, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
11. International transfers
Thuja is operated from the United States, and the sub-processors listed above process data in the United States and potentially other locations where they operate. If you use the service from outside the United States, your data will be transferred to and processed in the United States.
12. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you — for example by email or an in-product notice — before the changes take effect. The "Last updated" date above reflects the most recent revision.
13. Contact
Privacy questions and requests: hello@jointhuja.com. Thuja LLC, New Jersey.