Privacy policy

Last updated: November 2026

Who is responsible

Thanor, the library of AI design prompts at thanor.ai, is the controller of the personal data described here: it decides why and how that data is used. Thanor is run from Italy, so the EU General Data Protection Regulation (GDPR) and the Italian privacy code (Codice in materia di protezione dei dati personali) apply.

For anything in this policy, including every request about your data, write to support@thanor.ai. No data protection officer (DPO) has been appointed.

This policy covers thanor.ai, your Thanor account, the emails we send and the MCP connector that lets AI assistants such as Claude use Thanor. It does not cover the sites you build with our prompts or the AI tools you paste them into, which have their own terms.

What we collect

Your account. Your email address and your name. If you sign up with a password, the sign-in service stores it only as a hash (scrambled so it cannot be read back). We never store your password ourselves. If you sign in with Google, Apple, GitHub or Microsoft, that provider sends us your email address, your name, a link to your profile picture and an account ID. We also keep when the account was created, when you confirmed your email and when you last signed in.
Setup answers and profile. After you buy a plan we ask one optional question: what you will use Thanor for. Accounts set up earlier may also have given their role, how they heard about us and their name in a longer setup. In Settings you can change your role and your answer about what you use Thanor for, and add a company name and a profile picture. We also keep your plan and its status, renewal and cancellation dates, your email preferences and, if you make one, your deletion request.
What you do in the library. Which prompts you copy and when, which is how the daily copy limit works on plans that have one. The designs you save to your shortlist. A few account events: copying a free prompt, trying to copy a paid design, opening checkout and buying.
Payments.Checkout runs on Stripe’s own pages. Stripe collects your card, billing name and billing address, and records that you accepted our terms. We never see your card number. We keep the plan you bought, the amount, any discount and code used, the currency, the payment reference, refunds, the dates and your Stripe customer ID.
Support. The tickets you open from your account: subject, messages and attachments. With each ticket we keep your plan and subscription status, so we can understand the problem, and a priority and category label.
Contact and designer forms. These need no account. The contact form takes your name, email address, a subject and your message. The designer application takes your name, email address, a link to your work, what you would contribute and, if you give it, the email of your Thanor account.
Affiliate program. If you join as a partner, we keep your name and account email, your audience size and the social profiles you list. We also keep your partner code and commission rates, the PayPal email address you give us for payouts, and the commissions and payouts on your record. When someone opens a partner link, we count the click and note only the address of the site it came from. If you open a partner link and then sign up, sign in or buy within 60 days, your account is marked as referred by that partner (only the first partner counts), and a purchase earns them a commission. Partners see counts, plans and amounts, never who you are.
AI assistant connections (MCP).If you connect an AI assistant such as Claude to Thanor, we keep a record of that connection. It holds the app’s name, the web address it sends you back to after you approve it, and its access key, stored only as a hash. It also holds when the connection was created, last used, set to expire or revoked. Searches the assistant sends are used to answer and are not stored. Prompts fetched through the connector count toward the same daily limit as copies on the site and are recorded the same way.
Emails. Which emails we sent you, to which address and when, and which ones are queued. Where you are in the getting-started emails, and the personal discount code we sent accounts opened before 18 October 2026. Whether and when you opened our emails, which links in them you clicked and when, and whether you unsubscribed.
Page statistics. Our own measurement of how the site is used, with no third-party script. Each browser tab gets a random ID that disappears when the tab is closed. For each tab we record the pages you view, how far you scroll and how long a page stays on screen. We also record actions: opening a design, copying a prompt, starting checkout, seeing or clicking an offer and signing up. Along with these we note the site that sent you, any campaign labels in the link (such as utm_source), whether you are on a phone or a computer, and the country your connection comes from, as our hosting provider reports it. These records carry no account, name or IP address, and we do not link them to accounts. When you create an account we also save the country you signed up from on your profile, worked out the same way; we never store your IP address. Right after you create an account, the address bar may briefly show ?tn_new=1. It is removed at once, and the sign-up is counted in these statistics without your account.
Technical data. Our hosting provider logs your IP address, your browser type and the page requested, and our sign-in service logs the same details when you sign in. We also use your IP address in memory to limit repeated requests. We do not write it into our database.

To open an account you need an email address and either a password with your name, or a sign-in provider. Without them we cannot give you an account. The question on the plans page is optional. After you buy a plan, the three setup questions must be answered to finish setup: your answer about what you will use Thanor for shapes your product emails, and your role and how you heard about us help us understand who uses Thanor. A company name and a profile picture are optional. To buy a plan, Stripe needs your payment details.

Why we use it, and on what basis

“Legitimate interest” below means we have a genuine reason of our own and have checked that it does not override your rights and interests. You can object to any use that relies on it (see Your right to object).

Purpose	Data	Legal basis
Running your account and the library: sign-in, copy limits, shortlist, MCP connections, account email	Account, library use, MCP connections	Contract (art. 6(1)(b) GDPR)
Taking payments and keeping billing records	Payments	Contract; legal obligation under Italian tax law for the records (art. 6(1)(c))
Answering support, with urgent tickets read first	Support tickets, plan, subscription status and daily copy limit	Contract; legitimate interest in answering urgent problems first (art. 6(1)(f))
Understanding who uses Thanor and how people find it	Your role and how you heard about us	Legitimate interest in knowing who the library serves and which channels bring people to it (art. 6(1)(f))
Product email, its personalization, and measuring which emails work	Email address, name, your answer to “What will you use Thanor for?”, account events, email opens and clicks	Legitimate interest in telling account holders about the service they signed up for (art. 6(1)(f)); you can stop it at any time
Knowing whether our emails are opened	Email opens, recorded by Resend's tracking image in every email we send, account emails included	Legitimate interest in knowing that our emails reach people and get read (art. 6(1)(f)); setting your email app not to load images stops it
Marketing email	Email address, name	Your consent (art. 6(1)(a)), off until you turn it on
Sending a free download you asked for, like the playbook, and email from Matteo Manco and Thanor after it	First name, email address, where your visit came from, the sentence you agreed to, how often you downloaded the file	Your consent (art. 6(1)(a)), given with the form; withdraw it at any time with the unsubscribe link in any of those emails
Replying to the contact and designer forms	What you wrote in the form	Steps you asked us to take (art. 6(1)(b)); legitimate interest in answering you (art. 6(1)(f))
Running the affiliate program and crediting the right partner	Partner details, link clicks, the tn_ref cookie, referral marks, commissions and payouts	Contract with the partner; legitimate interest in paying commissions correctly (art. 6(1)(f))
Showing time-limited offers	The tn_flash cookie and the offer counters stored in your browser	Legitimate interest in offering discounts on our own plans (art. 6(1)(f))
Knowing which pages work	Page statistics, including country	Legitimate interest in improving the site (art. 6(1)(f))
Measuring visits, channels and purchases with Google Analytics	Pages viewed, actions on the site, device and approximate location, the purchase and its value	Legitimate interest in understanding which channels bring people to Thanor (art. 6(1)(f))
Measuring and improving our ads on Facebook and Instagram (Meta), for visitors outside the EEA, the UK and Switzerland	Pages viewed and actions on the site (designs opened, prompts copied, plans chosen, sign-up, checkout, purchase and its value), IP address, browser, the Meta cookies below, and your email address and account ID as one-way hashes	Legitimate interest in measuring and improving our advertising (art. 6(1)(f)); not used for visitors in the EEA, the UK or Switzerland
Security and preventing abuse	IP address, logs, bot checks	Legitimate interest in keeping the service and its users safe (art. 6(1)(f))
Internal alerts about sign-ups, sales, tickets and deletion requests	Shortened email, plan, amounts, codes, partner name, ticket excerpts, deletion requests	Legitimate interest in running the service (art. 6(1)(f))
Handling disputes and legal claims	The records the matter concerns	Legitimate interest in defending our rights (art. 6(1)(f)); legal obligation where one applies

Emails, and how to stop them

Account email (Settings calls it transactional email) always goes out, because it is part of the service. It covers confirmation and password links, notices when your password or email changes, receipts and plan notices (plan started, canceled, payment failed, access ended), and replies to your support tickets and the notice when one is resolved. Partners also get the program welcome.

Product email is about Thanor itself, and every account gets it. It starts with a welcome email that gives you a free guide. It can be followed by getting-started emails over your first weeks, chosen by what you do on the site: whether you have copied a free design, tried a paid one, or not been back for a while. If you try a paid design or leave checkout without buying, you can get a reminder, and a reminder after checkout can carry a discount on your first payment. Accounts without a plan can also get occasional free resources and offers about Thanor. If you buy a plan, the getting-started emails, reminders and offers stop.

Every product email has a one-click unsubscribe link, and Settings has a Product email switch. Either one stops product email right away and cancels anything already queued for you.

Marketing email (newsletters and general promotions) has its own switch in Settings. It is off by default and we send it only if you turn it on. You can turn it off at any time, and unsubscribing from any of our emails turns it off too.

Free downloads.When you ask for a free download, like the playbook, you give us your first name and email address and agree to get email from Matteo Manco and Thanor about AI web design, Thanor and related offers. We send you the download link, keep your address in our database and in Resend’s contact list, and note where your visit came from and when you downloaded the file. Every one of those emails has an unsubscribe link, which stops them.

Our emails are sent by Resend from its EU region in Ireland. Resend’s open tracking is switched on: each email carries a tiny invisible image, and when your email app loads it, Resend records that the email was opened and when. Email apps that block images, or load them through a proxy, report no open or a less accurate one. The image is in every email we send, account emails included, so unsubscribing from product email does not remove it; setting your email app not to load images does. Resend’s click tracking is switched off. Links in product emails pass through thanor.ai first, which records which link your account clicked and then takes you to the page.

How emails are personalized

Product emails are tailored to you. Which email you get, which version of the text and when a reminder goes out depend on four things:

your answer to “What will you use Thanor for?”
whether you have copied a free prompt
whether you have tried a paid design or left checkout
whether you have ever paid for a plan (only accounts that never have are offered the personal code).

We also record whether your account opens our emails and which links in them it clicks. We count opens, clicks and purchases per email to learn which emails are useful, and we may use your clicks to choose which emails you get next.

This only shapes our emails. No decision with legal or similarly significant effect is made about you automatically: nothing automatic decides whether you can have an account or a plan. You can object to this personalization at any time (see Your right to object).

Cookies and browser storage

We measure the site with our own page statistics and with Google Analytics. For visitors outside the European Economic Area, the UK and Switzerland we also use the Meta pixel, an advertising measurement tool; visitors in those countries never get it. The first time you visit, a short notice points to this section; closing it is remembered for six months.

This is everything thanor.ai itself stores in your browser:

Name	What it does	How long	Needed to use Thanor?
sb-…-auth-token (cookie, sometimes split into numbered parts)	Keeps you signed in	Up to 400 days, or until you sign out	Yes
sb-…-auth-token-code-verifier (cookie)	Completes sign-in with a provider or an email link securely	Only during sign-in; removed when it finishes	Yes
tn_ref (cookie)	Remembers which partner link you arrived from, so that partner is credited when you sign up or buy	60 days	No
tn_flash (cookie)	Remembers a time-limited offer shown in this browser, so you see the same offer if you come back	The length of the offer plus 30 days	No
thanor_gate (cookie)	Left over from the pre-launch preview, set only for people who entered the preview password; no longer used	30 days	No
tn_free_copies (local storage)	Counts the free prompts copied in this browser, to decide when to show an offer	Until you clear your browser storage or reject offers	No
tn_flash_offer (local storage)	The offer shown in this browser and when it ends	Until you clear your browser storage or reject offers	No
th_sid (session storage)	The random tab ID used for page statistics	Deleted when you close the tab	Exempt: anonymous first-party statistics; it identifies nobody
_ga and _ga_… (cookies, Google Analytics)	Tell visits from the same browser apart, so Google Analytics can count visitors and the channel that brought them	2 years	No
_fbp and _fbc (cookies, Meta)	Tell visits from the same browser apart and remember an ad click, so Meta can measure which ads bring people to Thanor. Only outside the EEA, the UK and Switzerland	90 days	No
tn_cc (cookie)	Your country as your connection shows it, so the Meta pixel is never loaded for visitors in the EEA, the UK or Switzerland	7 days	No
tn_consent (cookie)	Remembers that you closed the cookie notice, so it is not shown again	6 months, then we ask again	Yes
tn_pq (cookie)	Remembers that your account has answered the setup question, so we do not check again	1 year	Yes

The sign-in cookies are needed for the site to work. th_sid only lets us count visits and identifies nobody. The others are not needed to use Thanor: you can block or delete them in your browser at any time and the library keeps working, though a partner may then go uncredited and an offer may not be remembered. Deleting the sign-in cookie signs you out.

A few pages load a service from another company, which may use its own cookies under its own policy:

Google sign-inon the sign-in, sign-up and password reset pages. It loads when the page opens, so Google receives your IP address and can read its own cookies even if you do not choose Google. Google’s policy: policies.google.com/privacy.
Cloudflare Turnstileon the contact and designer forms, to check that you are a person. Cloudflare’s policy: cloudflare.com/privacypolicy.
Stripeon its checkout and billing portal pages, which Stripe hosts. Stripe’s policy: stripe.com/privacy.

Who receives your data

We use these providers to run Thanor. Each one receives only what its job needs.

Supabase (US company; data stored in the EU, in Stockholm, Sweden): the database, sign-in and file storage behind your account.
Vercel (US company; our server code runs in the EU, in Stockholm): hosts the site. Its network serves pages worldwide and keeps request logs (IP address, browser, page requested).
Resend (US company; sends from its EU region in Ireland): sends every email. It receives your email address, your first name and the content of each email, which can include your personal discount code. It may also keep a contact entry with your first name, plan status and email preferences.
Stripe (EU and United States): payments, tax, invoices, the billing portal and discount codes. It receives your email address, your account ID and the plan you choose, and collects your card and billing details itself. The personal discount codes we create for you are stored at Stripe, labeled with your account ID; when the account is deleted they are switched off and the label is removed. Stripe also uses this data for its own fraud checks and legal duties, under its own privacy policy.
Hostinger (EU company): hosts the support@thanor.ai mailbox. It receives a copy of each new support ticket (subject, message, your email address, your plan and the priority label) and any email you send us there.
Meta(Meta Platforms Ireland and Meta Platforms, Inc., United States), only for visitors outside the EEA, the UK and Switzerland: the Meta pixel and the Conversions API tell Meta which pages and actions an ad led to (a design opened, a sign-up, a checkout, a purchase and its value), with your IP address, browser, the _fbp and _fbc cookies, and your email address and account ID as one-way hashes, so Meta can measure and improve our ads on Facebook and Instagram. Meta’s policy: facebook.com/privacy/policy.
Google Analytics(Google Ireland and Google LLC, United States): counts visits, the pages and actions on them, the channel that brought each visit and purchases with their value. Google receives your IP address, which Google Analytics does not store, and the cookies listed above. It is not used for advertising. Google’s policy: policies.google.com/privacy.
Discord(United States): a private channel where the people who run Thanor get alerts about sign-ups, sales, tickets and account deletion requests. Alerts carry a shortened email (its first two characters and the domain), the sign-in method, the plan, amounts, discount codes, the referring partner’s name and code, the ticket subject, priority and category, the first 200 characters of each ticket message and customer reply, and the fact that an account asked to be deleted.
OpenRouter(United States): reads the subject and text of each new ticket, with your plan, subscription status and daily copy limit, and suggests a priority and category. It passes the request to Google’s Gemini model. We do not add your name or email, but anything you write in the ticket is sent with it. The label only sets the order in which tickets are read; a person answers every ticket.
Cloudflare (United States, global network): the Turnstile bot check on the contact and designer forms, which receives your IP address and signals from your browser.
Google, Apple, GitHub and Microsoft (United States): only if you use one of them to sign in. They confirm who you are, send us the details listed above and learn that you use Thanor. They also use this data for their own purposes, under their own privacy policies.
PayPal (Luxembourg, for EU accounts): pays affiliate commissions to the PayPal address a partner gives us, with the amount and a reference. PayPal handles it under its own privacy policy.

Inside Thanor, access is limited to the people who run the service and answer support. We do not sell your data, rent it or share it for advertising. We disclose data to public authorities only when the law requires it.

Transfers outside the EU

Several of these providers are based in the United States, or may access data from there for support and maintenance even when it is stored in the EU. These transfers rely on the EU-US Data Privacy Framework where the provider is certified under it. Otherwise they rely on the Standard Contractual Clauses: contract terms approved by the European Commission and included in the provider’s data processing terms. Sign-in providers and PayPal handle transfers under their own policies. To get a copy of the safeguards for a given provider, write to support@thanor.ai.

How long we keep it

Your account and the data tied to it are kept while the account is open.
After you ask to delete it, the account and the data tied to it are deleted within 30 days. Copies of your tickets in our support mailbox and the alerts about you in our private Discord channel are not removed by that step; write to support@thanor.ai and we delete them too. In Settings, the Delete my account button suspends your account at once. You can undo it from the same page until we process the request. You can also ask by writing to support@thanor.ai.
Billing and payment records, including affiliate commissions and payouts, are kept for 10 years, because Italian tax law requires it. They stay even after the account is deleted.
Messages sent through the contact, designer or partner application forms are kept until you ask us to delete them.
Internal alerts in our private Discord channel are kept until you ask us to delete them.
Support email: copies of your tickets and any email you send to support@thanor.ai stay in our mailbox until you ask us to delete them.
Server logsfollow our hosting provider’s and sign-in service’s own short retention periods.
Page statistics are not linked to your account, and we keep them with no set end date.
Google Analytics data is kept for 14 months.

Your rights

Under the GDPR you can:

get a copy of the personal data we hold about you;
have it corrected if it is wrong (most of it you can change yourself in Settings);
have it deleted (you can start this yourself in Settings);
have its use restricted while a question about it is settled;
receive it, or have it sent to another service, in a common machine-readable format;
object to uses based on our legitimate interest (see below);
withdraw any consent you gave, such as for marketing email, without affecting what was done before.

To use any of these rights, write to support@thanor.ai from the email address on your account. If you write from another address, we ask you to confirm the request from the account address first, so nobody else can get your data. It costs nothing. We answer within one month. If a request is complex we may need up to two more months, and we tell you why within the first month. If we cannot do what you ask, we tell you why within the same time, and you can then complain to the Garante.

You can also complain at any time to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the data protection authority where you live or work in the EU.

Your right to object

You can object at any time, and for any reason, to product email and its personalization, and we stop. Use the unsubscribe link in any product email, the Product email switch in Settings, or write to support@thanor.ai. The same goes for marketing email, which has its own switch in Settings.

You can also object to any other use based on our legitimate interest, for reasons related to your situation. We then stop, unless we have compelling reasons that outweigh yours, such as keeping the service secure or defending a legal claim.

Email opens work differently: Resend’s tracking image is set for all our email at once, so we cannot switch it off for one person. To stop it, set your email app not to load images; if you object by writing to us, we also stop using your opens for anything.

Age

You must be at least 14 to create an account, which is the age of digital consent in Italy. Paid plans require you to be 18, or to have a parent’s or guardian’s permission. If we learn that an account belongs to someone under 14, we close it and delete its data.

Security

Every connection to thanor.ai is encrypted. Passwords are stored hashed by the sign-in service, and MCP access keys are stored only as hashes. Database rules keep each account to its own data, support attachments sit in private storage, and the links in our emails are signed so they cannot be forged. Your profile picture, if you upload one, is stored at a public web address so it loads quickly, which means anyone with that exact link can see it. If a breach puts your data at risk, we notify the Garante and, where the risk to you is high, we tell you directly, as the GDPR requires.

The waitlist

Sign-ups to the pre-launch waitlist are closed. Entries from before launch (name, email address and the answer you gave) are kept in our database and in Resend’s contact list. They are not used for anything else, and they are kept until you ask us to delete them: write to support@thanor.ai and we delete both.

Changes

This version applies from October 2026. When the policy changes, the date at the top changes with it. If a change reduces your rights or uses your data in a new way, we email account holders before it takes effect.

← Back to Thanor