Privacy policy

This Privacy Policy (the “Policy”) explains how Thunderclap LLC, the owner and operator of the Thunderclap brand, handles your personal information. For the purposes of data protection law, Thunderclap LLC is the controller of your personal data.

Thunderclap is a social media growth service across Instagram, TikTok, YouTube, Facebook, X and LinkedIn. We take your privacy seriously and protect your personal information with care. This Policy explains how we collect, use, disclose and safeguard it when you visit thunderclap.com or use our Services. By visiting or using our website and Services, you acknowledge the practices described below.

1. Collection and use of personal information

We use the personal information we receive to fulfil your orders, to provide our Services, and for the related purposes described in this Policy. Our handling of it follows these principles:

• Purpose identification: before or when we collect personal information, we make clear what it is for.
• Use limitation: we collect and use personal information only for those purposes, or for compatible ones, unless you consent or the law requires otherwise.
• Retention: we keep personal information only for as long as those purposes require.
• Lawful and fair collection: we collect personal information by lawful and fair means and, where appropriate, with your knowledge or consent.
• Relevance and accuracy: the personal data we hold should be relevant to its purpose and, as far as that purpose requires, accurate, complete and up to date.
• Security safeguards: we protect personal information with reasonable safeguards against loss and theft, and against unauthorized access, disclosure, copying, use or modification.
• Transparency: we make information about how we manage personal information readily available to our customers, starting with this Policy.

What we collect

• When you order: your email address; the public profile or post URLs, or usernames, you want us to deliver to; the services and options you choose; any promo code you enter; and whether the promotions box at checkout was ticked (it is ticked by default). For Instagram orders, the username you type is looked up through our Instagram data provider so we can suggest the right account and show your public posts to choose from.
• When you create a customer account: your email address and password (handled by our customer-account provider), your order history, your credit balance and your subscriptions. If you ask us to change or cancel a subscription, we also receive the plan reference, the new username or your reason.
• When you contact us: your name, email address, subject and message.
• When you review Thunderclap: your name, email address, rating, the product you bought and your review. Reviews go to our team for moderation; nothing is published automatically.
• When you join a list or claim an offer: your email address and, if you give them, your first and last name — for our newsletter and promotions, the Thunderclap AI waitlist, or a free Social Growth Audit, which also takes your platform, account handle, order reference and notes.
• When you apply for a job: whatever you choose to send to our careers address.
• When you use our free tools: most run entirely in your browser. The TikTok profile-picture downloader sends the username you enter to our data provider to fetch that public profile.
• Automatically, when you browse: your IP address, device and browser type, approximate country, the pages you view, the page that referred you, and how you interact with our pages (such as clicks and scrolling). A first-party cookie also records how you first and most recently reached us — campaign tags, ad-click identifiers, the referring site and your landing page — and our forms send that summary along with your message. See section 4 and section 6.

What we never do

• We never ask for your passwords — every service ships from public-side engagement that doesn't require account access.
• We never sell or rent your personal data to anyone.
• We never store full card details on our servers — payment data stays with our payment partners.

2. Payment information

• Secure payment gateways: payments are processed by secure, PCI-DSS-compliant third-party payment providers. You enter your card details on the provider's own checkout page, never on our website, and every transaction is protected by SSL/TLS encryption.
• Limited payment details: we never collect or store full card numbers. We receive confirmation of each payment — such as the amount, currency, status and a transaction reference — and the provider may share limited card details with us, such as the card type or the last four digits. If you subscribe, your card is saved by the payment provider, not by us, so that it can be charged each billing period.
• Order attribution: to connect a purchase with the visit that led to it, we pass the analytics identifier stored in your browser and your approximate country to our payment provider with your order, and read them back when the payment is confirmed.

3. Use of information

We use your personal information to:

• provide, administer, analyze, improve and personalize our Services and our marketing;
• process your orders, payments, customer account, credits and subscriptions, and deliver what you ordered;
• communicate with you about your orders, deliveries, account and support requests and — if you left the promotions box ticked, subscribed to our emails, or where the law otherwise allows — about offers, including a reminder if you start a checkout and do not finish it, with a link that restores your cart;
• understand which campaigns and websites bring us visitors and customers;
• prevent, detect and investigate fraud, abuse and other prohibited or illegal activity, and enforce our Terms of service; and
• understand our audience and improve our website, including its user interface.

4. Analytics and customer engagement tools

We use the tools below to understand how our website is used and to communicate with our customers. They load when you visit our pages.

Google Analytics

Our website uses Google Analytics 4, a web analytics service provided by Google.

• Cookies: Google Analytics uses cookies to help us understand how visitors use our site. The information they generate about your visit is sent to Google and may be stored on servers in the United States. We also share how you first reached us (for example the campaign or referring site) with Google Analytics as properties of your visit.
• IP addresses: Google Analytics 4 does not log or store IP addresses. Google uses your IP address only to estimate your approximate location, and then discards it.
• Purchases: when an order is paid, our server also reports the purchase to Google Analytics — the order reference, value and items, linked to the analytics identifier in your browser, never your name or email address — so that it is counted even if you do not return to our site.
• Refusing cookies: you can refuse cookies through your browser settings, although some parts of our website may then not work fully.
• Opting out: you can stop Google Analytics from collecting data about you by installing Google's browser add-on at tools.google.com/dlpage/gaoptout.

For more detail, see how Google uses information from sites that use its services and Google Analytics' data protection information.

Microsoft Clarity

We use Microsoft Clarity to see how visitors use our pages, through heatmaps and session recordings of clicks, scrolling and mouse movement. Clarity uses cookies and processes data on Microsoft's servers. See the Microsoft Privacy Statement for more.

WebEngage and Redlap Engage

We use two customer-engagement platforms, WebEngage and Redlap Engage, to record the pages you view and actions such as adding items to your cart or starting a checkout, together with how you first reached us. They link that activity to your email address once you give it to us — when you enter it at checkout with the promotions box ticked, subscribe to our emails, join a waitlist, or place an order. We use them to send emails about your order and, where you agreed or the law allows, offers and reminders.

Ahrefs Web Analytics

We use Ahrefs Web Analytics for page-view statistics. It works without cookies and does not build individual visitor profiles.

Advertising

We do not currently place advertising or remarketing pixels, such as Google Ads tags or the Meta Pixel, on our website. If that changes, we will update this Policy.

5. Disclosure of information

We use other companies (“Service Providers”) to perform services on our behalf or to help us provide our Services to you. They include providers of:

• website hosting, content delivery and security — Amazon Web Services and Cloudflare;
• payment processing, recurring billing and customer accounts — Redlap and the payment processors it works with;
• order fulfilment — the partners who deliver your order receive the URL or username and the quantity needed to do it;
• email delivery — Zoho;
• analytics and customer engagement — Google, Microsoft, WebEngage, Redlap Engage and Ahrefs;
• form protection against spam and abuse — Google reCAPTCHA; and
• public social-media data lookups — HikerAPI (Instagram accounts and posts at checkout) and ScrapingBee (public TikTok profiles for our free profile-picture tool).

Service Providers may have access to your personal information, but they are not authorized by us to use or disclose it except as needed to perform services for us.

We may also disclose personal information:

• where the law, a court order or a competent authority requires it;
• to protect the rights, property or safety of Thunderclap, our customers or others — including to prevent fraud and to respond to payment disputes; and
• to a buyer or successor if our business, or part of it, is sold or reorganized.

International transfers

We are based in the United Arab Emirates, and our Service Providers operate in several countries, including the United States and the European Union. Your information may therefore be processed outside the country where you live. Where data protection law requires it, we rely on appropriate safeguards for those transfers, such as standard contractual clauses.

6. Cookies and browser storage

A cookie is a small piece of data that a website stores in your browser. We and our Service Providers use cookies, and similar technologies such as your browser's local storage, to run our website and to improve it. They fall into three groups:

• Needed to run the site: your cart and its options, your sign-in to the customer dashboard, a promo code from a campaign link (kept only for your visit), and small preferences such as a banner you have dismissed. These are kept in your browser's storage, on your device.
• Attribution: a first-party cookie named tc_attr holds a random visitor ID and how you first and most recently reached us (campaign tags, ad-click identifiers, the referring site and your landing page), for up to 2 years.
• Analytics and engagement: cookies and identifiers set by Google Analytics, Microsoft Clarity, WebEngage and Redlap Engage, as described in section 4. Once you have given us your email address, some of these are linked to it.

You can set your browser to tell you when a cookie is set, to block cookies, or to delete them, and clearing your browser's data for our site removes what we keep in its storage. If you block cookies or storage, some features — such as your cart and checkout — may not work.

7. Retention and security

We keep personal information only for as long as we need it for the purposes in this Policy — for example, order records for as long as we need them for accounting, tax and dispute purposes — unless the law requires or permits us to keep it longer. We protect it with industry-standard encryption (256-bit SSL) in transit, and access to your data is restricted to authorized team members. No method of transmission over the internet, or of electronic storage, is completely secure, however, so we cannot guarantee absolute security.

8. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy of it;
• have inaccurate information corrected;
• have your information deleted, including your customer account;
• object to, or ask us to restrict, how we use it, including for analytics and marketing;
• withdraw any consent you have given, at any time; and
• complain to a data protection authority.

To stop marketing emails, use the unsubscribe link in any marketing email or contact us. To exercise any other right, email support@thunderclap.com; we may need to verify your identity before we act on a request.

9. Children

Our Services are not directed at anyone under 18, in line with our Terms of service. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact support@thunderclap.com and we will delete it.

10. Governing law

This Policy, and any dispute arising out of or relating to it, is governed by the laws of the United Arab Emirates, without regard to conflict-of-law principles, and the courts of Dubai, United Arab Emirates, have exclusive jurisdiction over any such dispute. This does not affect any rights you have under the data protection laws of the country where you live, including the right to complain to your local supervisory authority.

11. Changes to this policy

We may change this Policy at any time. Changes take effect when the revised Policy is posted on this page with a new “last updated” date; material changes will also be announced here and, where appropriate, by email. If you continue to use our website or Services after that, the revised Policy applies to you.

12. Contact information

If you have a question about this Policy or about how your personal information is handled, email support@thunderclap.com, use our contact form, or write to us at the address below.

By continuing to use our Services, you acknowledge that you have read and understood this Policy.