Thicket Privacy Policy
Version 1.0
Effective: October 19, 2026
This Privacy Policy explains how Rubus Labs LLC, a Delaware limited liability company ("Rubus Labs," "we," "us," or "our") collects, uses, shares, and protects personal information through Thicket at getthicket.com and dashboard.getthicket.com, our company website at rubuslabs.com, and related services (the "Service"). Our BLUF newsletter at getbluf.com has its own privacy notice at https://getbluf.com/privacy.
Thicket is a brand-protection service for businesses and the attorneys who represent them. This policy covers (1) information about our customers and their users, and (2) information about third parties that we collect while monitoring for and documenting suspect domains and websites.
1. Information We Collect
Information you give us
- Account and contact information: name, work email, phone number, job title, and login credentials.
- Company and brand information: company name, brands, trademark registrations, logos and other brand assets, domains you own, and designated approvers (which may include your attorney).
- Letter of Authorization (LOA) information: the signer's name, title, email, signature, date, IP address and browser, and related signing records.
- Communications: messages you send us, support requests, and your approvals or rejections of cases and notices.
Payment information
Payments are processed by Stripe. We do not store full card numbers. We receive limited information from Stripe, such as billing name, billing address, the last four digits of the card, card type, and transaction history.
Information collected automatically
- Usage and log data: server and security logs, including IP address, browser and device type, actions taken in the Service, timestamps, and error logs.
- Website analytics: aggregated visit data from Cloudflare Web Analytics, such as pages viewed, referring site, country, and browser and device type. See Section 9.
- Acceptance records: when you accept our Terms of Service, Refund Policy, or this Privacy Policy, we record the version accepted, the date and time, your account and session details, and the IP address used.
- Attribution data: if you sign up from a link that carries campaign tags (source, utm_source, utm_medium, and utm_campaign), we store those tags with your account. We do not use cookies for this.
- Cookies and similar technologies: see Section 9.
Information about third parties (monitoring and captures)
To provide the Service, we collect information about domains and websites that may infringe our customers' brands. This can include:
- Suspect domain names found through DNS permutations and certificate-transparency logs.
- Published registration records, which may contain personal information of domain registrants, such as names, email addresses, phone numbers, and postal addresses, where not redacted by the registrar.
- We do not use this information to identify, locate, or build profiles of individuals.
- Screenshots and page captures of public websites, which may show names, images, or other personal information that appears on those sites.
- Technical data about suspect sites, such as IP addresses, hosting and DNS providers, and SSL certificate details.
We collect this information from public or publicly accessible sources, for the purpose of brand protection and the prevention of fraud, phishing, and infringement. Thicket monitors domains and websites only. It does not monitor social media or online marketplaces.
Business contacts for outreach
- Prospective customers: name, work email, firm or company, title, business address, and the public source where we found them (for example, a firm or company website or a published domain-dispute decision). We use this only for business-to-business email about Thicket. You can opt out at any time as described in Section 8.
2. How We Use Information
We use information to:
- Provide, operate, and maintain the Service, including monitoring, capture of timestamped screenshots and records, AI-assisted analysis, and timestamped record sets.
- Verify domain ownership (through DNS TXT records) and the authority behind LOAs.
- Prepare notices and, after customer approval, send them to registrars, hosts, CDNs, blocklists, and other recipients.
- Process payments, track takedown credits, and manage subscriptions.
- Keep records of your acceptance of our terms and policies.
- Communicate with you about your account, cases, approvals, renewals, and support.
- Send product updates and marketing, where permitted. You can opt out at any time.
- Measure and improve the Service and our marketing, including through attribution data.
- Protect the Service, prevent misuse (such as false or abusive notices), and keep it secure.
- Comply with law, enforce our Terms of Service, and establish, exercise, or defend legal claims.
3. Legal Bases
We process personal information as needed to provide the Service under our contract with customers, for our legitimate business interests (such as protecting brands from infringement and fraud, securing the Service, and improving it), to comply with legal obligations, and with consent where the law requires it.
Service area: Thicket is offered only to customers in the United States. We do not offer the Service to individuals or businesses in the EEA, UK, or Switzerland.
4. AI Processing
Thicket uses two AI service providers: OpenAI and Anysphere, Inc. (Cursor). OpenAI is used, through OpenAI's global API endpoint, to analyze suspect websites against a customer's brand and a review rubric and to find the right abuse contacts and reporting forms. Information sent to OpenAI may include screenshots, page text, domain names, published registration records (which may include a registrant's contact details where the registry does not redact them), and the customer's brand name and domain.
- AI output assists the customer's review. AI does not make final decisions on notices. The customer or its designated approver approves every notice before it is sent.
- We do not use customer data to train AI models, and we do not permit our AI service providers (OpenAI and Anysphere, Inc. (Cursor)) to use it to train their models. OpenAI may keep API inputs and outputs in abuse-monitoring logs for up to 30 days and does not otherwise store them.
- AI analysis can be inaccurate. Customers should review the timestamped screenshots and records before approving action.
5. How We Share Information
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:
Service providers (subprocessors)
We use service providers that process information on our behalf under contracts that limit their use of it. They include:
| Provider | Purpose |
|---|---|
| Cloudflare (including Cloudflare Access) | Hosting, database and file storage, browser rendering (screenshots and page capture), job queues, dashboard sign-in, and aggregated site analytics (Cloudflare Web Analytics) |
| OpenAI | AI-assisted analysis and abuse-contact lookup. Receives screenshots, page text, and published registration records, which may include registrant contact details. Global API endpoint; not used for training; abuse-monitoring logs kept up to 30 days. |
| Resend | Email delivery (outbound notices and approval emails, and inbound replies). Data stored in the US and kept for 30 days. |
| Stripe | Payment processing |
| DigiCert, Inc. (primary) and freeTSA.org (fallback) | RFC 3161 trusted timestamps for record sets. These services receive only a cryptographic hash (SHA-256) of the record set manifest, plus standard network request data. They do not receive screenshots, registration records, or other content of the record set. |
| Google (Google Workspace) | Business email, including outreach email to prospective customers and replies |
| Anysphere, Inc. (Cursor) | AI automation platform we use to operate, monitor, and support the Service. It may process account and case data. Under the privacy settings we use, Cursor and its AI model providers do not train on this data. |
We also use AI and automation service providers, including Anysphere, Inc. (Cursor), to help us find public business contacts and draft, send, and manage outreach email. We use these providers under their business terms and privacy settings, and we limit the information we share with them to what is needed for outreach: prospect contact details, the public source where we found them, and message content.
Recipients of takedown and abuse notices
When a customer approves a notice, we send it to recipients such as domain registrars, hosting providers, CDNs, blocklists (for example, Netcraft, APWG, Google Safe Browsing, and Microsoft SmartScreen), and platforms receiving DMCA notices. DMCA notices are sent only when the customer identifies a specific copyrighted work and e-signs the required statements; trademark, impersonation, and phishing complaints are filed as IP and impersonation reports under each recipient's own reporting process. Notices include record sets (which may contain published registration records and screenshots) and the details the customer has authorized, such as the rights holder's name and contact information. These recipients handle information under their own policies, and some may share it with the site operator or publish it (for example, DMCA notices may be forwarded to the alleged infringer or shared with public databases such as Lumen).
Public record set links
Customers can create time-limited public links to record sets. Anyone with the link can view the record set until the link expires.
Legal and safety
We may disclose information to law enforcement, regulators, or others when required by law, subpoena, or court order, or when we believe in good faith it is needed to protect rights, safety, or property, or to prevent fraud or abuse.
Business transfers
If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
With your direction
We share information with others when you ask us to, such as with your attorney.
6. Data Retention
We keep information only as long as needed for the purposes in this policy. Our default retention periods are:
| Data | Retention |
|---|---|
| Account data | Life of the account; deleted within 30 days of a deletion request or account closure, except as listed in this section |
| Timestamped record sets and case records | Kept while the account is active; deleted within 30 days of a deletion request or account closure. Deleted data leaves backups within 30 days after that. |
| Scan results for discovery candidates that do not become cases | 30 days |
| Public record set links | Expire after 30 days; we can reissue a link on request. The underlying record set follows the case-record retention period |
| Payment and billing records | 7 years, as required by tax and accounting law |
| Acceptance records and notice approval records (who approved, when, and the approved text) | Life of the account + 6 years |
| Usage and log data | Server logs: up to 7 days. Dashboard sign-in logs: up to 90 days |
Records of each notice sent or filed (recipient, approver, signer, and outcome) and DMCA signature records (including the signer's IP address and browser) are kept for the life of the account plus 6 years, including after an account or case is deleted, to establish, exercise, or defend legal claims. Database backups are kept for 30 days. Outreach records. We keep records of our outreach to prospective customers (contact details, the public source where we found them, and messages sent and received) for up to 24 months after our last contact, then delete them. We keep suppression-list entries (email address or domain and the date of the opt-out) indefinitely so that we continue to honor opt-out requests. Copies of outreach messages may also remain in the conversation history of the AI tools we use to run outreach until they are deleted from those tools. We may keep information longer when required by law or needed to resolve disputes or enforce our agreements. When information is no longer needed, we delete or de-identify it.
7. Security
We use reasonable administrative, technical, and physical safeguards to protect information, including encryption in transit, access controls, and cryptographic hashing and trusted timestamps to protect the integrity of captured records. We timestamp record sets by sending a SHA-256 hash of the record set manifest to independent RFC 3161 timestamp authorities. The authorities never receive the underlying files. No system is completely secure, and we cannot guarantee absolute security. If a data breach affects your personal information, we will notify you as required by law.
8. Your Choices and Rights
All users
- Access and update: you can review and update account information in your account settings or by contacting us.
- Marketing: you can stop marketing emails at any time by replying "unsubscribe" to any of them, using an unsubscribe link where one is provided, or emailing [email protected]. We keep a record of opt-outs so we don't contact you again. We will still send account and service messages.
- Deletion: you can ask us to delete your account. Some information may be kept as described in Section 6.
US state privacy rights
Depending on where you live, laws such as the California Consumer Privacy Act (CCPA) and other state privacy laws may give you the right to:
- Know what personal information we collect, use, and disclose, and get a copy of it.
- Correct inaccurate personal information.
- Delete personal information, subject to exceptions.
- Opt out of the "sale" or "sharing" of personal information, targeted advertising, and certain profiling. We do not sell personal information.
- Limit the use of sensitive personal information (we do not intentionally collect it for that purpose).
- Not be discriminated against for exercising these rights.
To make a request, email [email protected]. We will verify your identity before responding. You may use an authorized agent, who must provide proof of authorization. If we deny your request, you may appeal by replying to our decision or emailing [email protected] with "Appeal" in the subject line.
Registrants and other third parties: if your information appears in published registration records or website captures we collected, you may contact us with a request. We will consider it under applicable law, keeping in mind our customers' legal interests in brand enforcement and record preservation.
We honor the requests described above for all users, whether or not a particular state privacy law applies to us.
9. Cookies and Analytics
We use only the cookies needed to sign you in to the dashboard and keep the Service secure. Our hosting provider, Cloudflare, may also set security cookies to detect bots. We use Cloudflare Web Analytics to count page visits on getthicket.com and rubuslabs.com. It does not set cookies or use local storage, and Cloudflare does not use it to identify you or follow you across other websites. We do not use advertising cookies, pixels or trackers. Campaign tags in a signup link are stored with your account without cookies (see Section 1). You can control cookies through your browser settings; blocking some cookies may affect how the Service works. We do not sell or share personal information for cross-context behavioral advertising and do not use advertising trackers, so there is nothing for a Global Privacy Control or Do Not Track signal to switch off. If we add such tools, we will honor GPC as an opt-out.
10. Children
The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it. Website captures may incidentally include images or information about minors that appear on public sites; we use these only as part of record sets for brand protection.
11. International Transfers
We are based in the United States, and the Service is offered only to customers in the United States. Our service providers may process information in the United States and other countries. Thicket does not offer the Service in the EEA, UK, or Switzerland.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Each version is labeled with a version number and effective date. We keep each prior version, and will provide a copy on request. We will give customers at least 30 days' notice of any material change by email and in the Service before it takes effect. Customers who object to a material change may cancel as described in Section 21 of our Terms of Service, including a pro-rated refund of prepaid fees for the unused part of their term.
13. Contact Us
Rubus Labs LLC, 5124 Polen Drive, Dayton, OH 45440
Email: [email protected]
Website: getthicket.com and rubuslabs.com