Last updated: August 18, 2025

Thunderbay Technologies ("Thunderbay," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our websites, engage with us on social media, contact us, apply for roles, or use our products and services (collectively, the "Services").

This Policy is designed for a global audience and includes region‑specific notices and rights. Where local law requires a higher standard, we apply that standard for residents of that jurisdiction.

Controller. Thunderbay Technologies, 2590 Welton St, Ste 200, Num 1193, Denver, CO 80205, USA, is the controller for the personal information described in this Policy unless otherwise stated.

Audience. Our Services are intended for business users and prospective clients. We do not market to children.

Not legal advice. This Policy explains our practices and your rights. It is not legal advice.

We collect personal information in three ways: you provide it to us, we collect it automatically, or we receive it from third parties. The types of information we collect include:

A. Information you provide

• Contact details (name, company, job title, email, postal address, phone if provided)
   
• Account and preference information
   
• Inquiry and support content (messages, meeting notes, feedback)
   
• Business opportunity details (project scope, budgets, timing)
   
• Job application data (CV/resume, cover letters, work history, references)
   
• Consent records and privacy requests
   

B. Information collected automatically

• Device and network data (IP address, device identifiers, browser type, operating system)
   
• Usage data (pages viewed, referring/exit pages, timestamps, error logs)
   
• Approximate location from IP
   
• Cookies and similar technologies (pixels, tags, SDKs, local storage). See Section 7.
   

C. Information from third parties

• Lead and analytics partners
   
• Social networks (if you interact with our pages or ads)
   
• Background check providers and recruiters (applicants)
   

We do not intentionally collect sensitive personal information (e.g., precise location, government IDs, financial account numbers, health data) through our corporate website. If you choose to submit such information, we will handle it as described in this Policy and delete or restrict it if not necessary.

We process personal information for:

• Service delivery: to operate, maintain, and provide the Services
   
• Communications: to respond to inquiries, send administrative messages, and provide updates you request
   
• Business development & marketing: to run campaigns, measure performance, and personalize content (where permitted by law)
   
• Security & fraud prevention: to detect, prevent, and respond to misuse and security incidents
   
• Compliance: to meet legal, tax, accounting, and regulatory obligations; to exercise or defend legal claims
   
• Recruiting: to assess and manage job applications
   
• Product improvement: to study how users interact with our Services and improve quality
   

Where required, we rely on the following legal bases: contract (to provide Services you request), consent (e.g., cookies or direct marketing where consent is required), legitimate interests (e.g., site security, business analytics, B2B marketing consistent with your interests), and legal obligation. Where we rely on legitimate interests, we balance them against your rights and expectations.

If you interact with AI features, chat tools, or automations we host:

• Your inputs and outputs may be logged to operate the feature, troubleshoot, and improve safety.
   
• We do not allow vendors to train public models on your content without a contract permitting it and, where required, your consent.
   
• We do not use fully automated decision‑making that produces legal or similarly significant effects without human review.
   

We share personal information with:

• Service providers (hosting, analytics, security, CRM, recruiting, email/SMS)
   
• Professional advisors (legal, tax, auditors)
   
• Affiliates and corporate transactions (merger, acquisition, or asset sale)
   
• Authorities when required by law or to protect rights, safety, or property
   

We do not sell personal information. We may "share" identifiers and internet activity with advertising and analytics partners for cross‑context behavioral advertising where permitted by law. See Section 8 for opt‑out.

We use cookies, pixels, and local storage to keep you signed in, remember preferences, secure the site, and analyze usage. Where required, we ask for your consent and honor withdrawal at any time.

• Strictly necessary cookies: site security and core functionality.
   
• Performance/analytics: traffic measurement and diagnostics.
   
• Advertising (if used): to measure and deliver relevant ads.
   

You can control cookies via our banner, browser settings, and device settings. If you disable cookies, parts of the site may not work as intended.

• Marketing: You may opt out of marketing emails by using the unsubscribe link. Transactional messages may still be sent.
   
• Targeted advertising / “sharing”: Where applicable law provides the right to opt out of cross‑context behavioral advertising, we provide a “Your Privacy Choices / Do Not Sell or Share” link and honor Global Privacy Control (GPC) signals.
   
• Analytics: You can opt out via our banner or by using relevant browser settings.
   

We are based in the United States and may transfer information to countries that may not provide the same level of data protection as your home country. When we transfer personal data from the EEA, UK, or Switzerland, we rely on approved transfer mechanisms (e.g., EU Standard Contractual Clauses, UK Addendum/IDTA, and Swiss addenda) and implement additional safeguards where appropriate. We also assess vendor risk and require contractual protections.

We keep personal information only as long as necessary to fulfill the purposes described in this Policy, including to comply with legal, accounting, or reporting requirements. Typical periods:

• Contact, inquiry, and CRM records: 24–36 months after last interaction
   
• Contract and transaction data: 7 years (or longer if required)
   
• Security logs: 12–24 months
   
• Recruitment data: 24 months (unless law requires longer or you consent to longer retention)
   

We use administrative, technical, and physical safeguards appropriate to the nature of the information, including encryption in transit, access controls, least‑privilege practices, and vendor due diligence. No method of transmission or storage is perfectly secure.

Our Services are not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us to request deletion.

Depending on your location, you may have rights to access, correct, delete, port, object or opt out of certain processing (including targeted advertising and profiling), and to withdraw consent at any time where we rely on consent. You may also have the right to appeal our response to your request and to lodge a complaint with a regulator. See the regional notices below for details.

How to exercise your rights. Email admin@thundercityproperties.com or write to the address in Section 1. We may verify your identity and request limited additional information to process your request. Authorized agents may submit requests where permitted by law, subject to verification.

Appeals. If we deny your request in a jurisdiction that requires an appeal process, you may appeal by replying to our decision email with the subject line “Privacy Request Appeal.” If your appeal is denied, you may contact your local regulator.

• Controller: Thunderbay Technologies (see Section 1).
   
• Legal bases: See Section 4.
   
• Transfers: See Section 9. For EEA/UK/Swiss residents, you may request a copy of the transfer mechanism applicable to your data.
   
• Your rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.
   
• Complaints: You may lodge a complaint with your local authority (e.g., ICO in the UK or your EEA supervisory authority).
   
• Cookies/ePrivacy/PECR: We obtain consent where required for non‑essential cookies and direct marketing.
   

• No sale of personal information. We may share identifiers and internet/network activity with advertising or analytics partners for cross‑context behavioral advertising.
   
• Your rights: know/access, correct, delete, portability, opt out of sale/sharing and targeted advertising, limit the use and disclosure of sensitive personal information (we do not use SPI beyond permitted purposes), and non‑discrimination.
   
• Signals: We honor GPC signals and browser‑level opt‑out preference signals.
   
• Authorized agents: Accepted subject to verification. We maintain records of requests as required by law.
   

Categories collected (last 12 months): Identifiers; commercial information (B2B only); internet and network activity; approximate geolocation; inferences (marketing segments). We do not knowingly collect precise geolocation, biometric data, or financial account numbers via our website.

Residents of states with comprehensive privacy laws have rights similar to those described in Section 13, including the right to opt out of targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects. You may also have the right to appeal our decision. Submit requests as described in Section 13.

You may request access to and correction of personal information we hold about you. We process your information in accordance with fair information principles and implement appropriate safeguards for cross‑border transfers. Contact admin@thundercityproperties.com with “PIPEDA Request” in the subject line.

You have rights to confirm processing, access, correction, anonymization, portability, deletion, information on sharing, and withdrawal of consent. Where applicable, we rely on consent, contract, or legitimate interest. Contact admin@thundercityproperties.com with “LGPD Request.”

You may request access, correction, deletion, and lodge complaints with the Information Regulator. We process personal information in line with POPIA’s conditions for lawful processing.

Swiss residents have rights to access, rectification, deletion, and objection. We apply Swiss‑approved transfer addenda for cross‑border data flows where required.

Australian residents have rights to access and correction and may complain to the OAIC. We will respond to complaints within the timeframes required by the APPs.

We process personal data of Indian residents consistent with the Digital Personal Data Protection Act, 2023 and forthcoming rules. You may withdraw consent and exercise access/correction/erasure rights by emailing admin@thundercityproperties.com with “DPDP Request.” Where cross‑border transfer restrictions apply, we follow the Government of India’s notified conditions.

We do not intentionally collect “consumer health data” as defined by MHMDA. If you submit information that could be considered consumer health data, we will use it only for the purpose you provided, obtain any required consent, and honor deletion and access rights. We do not permit geofencing of locations in a manner prohibited by MHMDA.

We do not target or offer the Services to individuals located in Mainland China. If we nevertheless process personal information subject to China’s Personal Information Protection Law (PIPL), we will obtain separate consent where required, identify the personal information processor, disclose contact methods, conduct required impact assessments, and implement approved cross‑border transfer mechanisms. You may request access, correction, deletion, and withdrawal of consent.

We do not sell covered information. Nevada residents may email admin@thundercityproperties.com with “Nevada Do Not Sell Request.”

Our Services may link to third‑party websites or services. Their privacy practices are governed by their own policies.

We may update this Policy from time to time. If we make material changes, we will post the updated version and change the "Last updated" date. Where required, we will notify you and, if needed, request your consent.

No mobile information will be shared with third parties/affiliates for marketing or promotional purposes.

By providing your mobile number, you agree to receive text messages from Thunderbay Technologies Inc. at the number provided. Message frequency varies and may include customer support updates or related communications. Message and data rates may apply. Reply STOP to opt‑out at any time. Reply HELP for support.

We may update this Policy from time to time. If we make material changes, we will post the updated version and change the "Last updated" date. Where required, we will notify you and, if needed, request your consent.

Email: admin@thundercityproperties.com
Postal: Thunderbay Technologies, 2590 Welton St, Ste 200, Num 1193, Denver, CO 80205, USA.

If you need this Policy in an alternative format due to a disability, contact us at the email above.

We maintain records of processing activities, vendor inventories, and data protection impact assessments (where required). We limit access to personal information to personnel and service providers with a legitimate need and subject them to confidentiality obligations.

This Policy applies in addition to any service‑specific terms agreed in writing. In case of conflict, the stricter term prevails for the protected individual.