Privacy Policy

This is the privacy policy for Kintaria, the family-care coordination service operated by THRIVE.ME Corporation. It explains what we collect, how we use it, who we share it with, and how to ask us to delete it. It covers the marketing site (thrive.me), the application (my.thrive.me), the research survey, and the voice line at (888) 704-0999.

1. Who we are

Kintaria is a product of THRIVE.ME Corporation, located at 2007 W Carson St, Torrance, CA 90501, United States. For any privacy-related question, write to info@thrive.me or call(888) 704-0999.

2. What we collect

2.1 Information you give us directly

• Email address, when you sign up or submit the research survey. We use it to send sign-in links, transactional notifications, billing receipts, and (if you opt in) the weekly digest.
• Workspace content, whatever you enter into your family workspace at my.thrive.me — appointments, medications, lab values, doctor-visit notes, documents, the parent profile, emergency contacts, plan checklists, and any free-text notes.
• Member emails, of the people you invite into your workspace.
• Billing information, if you start a paid subscription — handled by Stripe. We never see or store full card numbers.
• First name + survey responses, when you submit the research survey.
• Phone number, if you opt into two-step sign-in codes, or if you call us at (888) 704-0999 (caller ID).

2.2 Information collected automatically

• Anonymous page-visit data via Plausible Analytics — pages visited, referrer, country, device type. Cookie-free, does not track individuals across sites.
• Server logs — IP address and user-agent string for each request, retained for up to 30 days for security and debugging.

2.3 What we don't collect

• We do not use tracking cookies, advertising pixels, session replay, or behavioral profiling.
• We do not share workspace content with advertisers or data brokers.
• We do not train external AI models on your workspace data — see section 4a.

2.4 Phone number for SMS verification

When you enable two-step sign-in via SMS, we collect your mobile phone number to send 6-digit sign-in codes. We do not use this number for marketing, do not share it with advertisers, and do not sell it. Messages are delivered by Twilio on our behalf under a contract that limits how they may process the number.

You can opt out at any time by replying STOP to any message, or by removing your number from Settings → Security in the app. Either action disables SMS sign-in for your account immediately.

Message frequency depends on your sign-in activity (typically 1–4 messages per sign-in attempt). Message and data rates may apply, charged by your mobile carrier.

3. How we use what we collect

We use your information only to:

• Operate the family workspace.
• Send transactional emails — sign-in links, billing receipts, trial-ending heads-ups, invitations, the weekly digest if enabled.
• Respond to your questions or follow-up requests.
• Understand at an aggregate level which pages people find useful (cookieless analytics).
• Secure the service against abuse (rate limiting, debugging, audit logs).

We do not sell, rent, or share your personal information with advertisers, data brokers, or other third parties for their own use.

4. Service providers we use

Each receives only what they need to do their job.

• Vercel — hosts the marketing site and application.
• Supabase — hosts the application database (Postgres), authentication, and the document vault. Data is encrypted at rest and in transit.
• Stripe — processes paid subscriptions.
• Resend — delivers transactional email.
• Plausible Analytics — counts page visits. Cookie-free.
• Anthropic — provides the Claude API used by AI features. Per Anthropic's API policy, inputs are not used to train models. See section 4a.
• Twilio — sends two-step sign-in codes (and connects voice calls to (888) 704-0999). See our SMS Policy for the opt-in, frequency, and STOP/HELP details.
• Tally — hosts the research survey.
• Deepgram, ElevenLabs — process call audio for the voice line.
• Fly.io — hosts the voice-line backend.

4a. How AI features handle your content

Two product features in Kintaria use a third-party AI model from Anthropic:

• Visit summary — text you paste into a visit-summary form is sent to Anthropic and turned into a structured summary.
• Smart upload — documents you upload via the smart-upload flow are sent to Anthropic to classify and summarize.

• Transport. TLS-encrypted.
• Retention. Per Anthropic's API policy, inputs/outputs may be retained for up to 30 days for safety monitoring, then deleted.
• Training. Anthropic does not use API data to train its models. This is their default behavior, not an opt-in.
• Your control. AI features are off by default for every new workspace. The owner has to explicitly turn them on in Settings → AI features, and can turn them off again at any time.

Current compliance posture. Kintaria applies HIPAA-aligned controls but is not itself a HIPAA-covered entity. For organizations that need a Business Associate Agreement (BAA), one is available on request — email info@thrive.me.

5. How long we keep your information

• Account + workspace data: kept while your workspace is active. After a free trial ends without subscribing, the workspace becomes read-only for 30 days, then locked. Not permanently deleted without explicit owner request, or after 12 months of locked-and-inactive state.
• Exported workspace bundles: we keep no copy after download.
• Billing records: 7 years per US tax requirements (in Stripe).
• Survey responses + contact info: contact info deleted within 90 days of the study's end.
• Call recordings and transcripts: 90 days, then automatic deletion. Earlier on request.
• Server logs: up to 30 days.
• Anthropic API inputs/outputs: up to 30 days for safety monitoring on Anthropic's side, then deleted.

6. Your rights

You can ask us to:

• Confirm whether we have personal information about you, and what it is.
• Delete it.
• Correct it.
• Stop using it for any specific purpose (e.g., remove you from the digest).
• Receive a copy in a portable format.

Email info@thrive.me. We'll respond within 30 days. You don't need to be a California resident to exercise these rights — we extend them to everyone.

6.1 California residents

If you live in California, you have additional rights under the CCPA and CPRA. The categories described in sections 2, 3, and 4 above cover this. We do not “sell” or “share” personal information in the technical CCPA sense.

7. Children

Kintaria is intended for adults coordinating care for an aging parent. We do not knowingly collect personal information from children under 13.

8. Security

We transmit all data over TLS, store contact information separately from research responses where possible, and limit administrative access to the founder. No system is perfectly secure — if you believe your information has been improperly accessed, write to us immediately.

9. International users

Our servers are in the United States. If you are using Kintaria from outside the US, your information will be transferred to and processed in the US.

10. Changes to this policy

We'll update this policy any time material changes warrant it. The “Last updated” date at the top will change, and significant changes will be announced by email to account holders at least 30 days before they take effect.

11. Contact