ThingsBoard Privacy Policy

Revision Date: October 16, 2026

1. Introduction and Scope

This Privacy Policy (“Policy”) governs the collection, processing, use, disclosure, and protection of personal data by ThingsBoard, Inc. (“ThingsBoard,” “we,” “us,” or “our”) across all our operational touchpoints, including our corporate website (thingsboard.io), the ThingsBoard License Portal (https://license.thingsboard.io, hereinafter the “Portal”), our cloud services (ThingsBoard Cloud), IoT software ecosystem, customer support channels, and administrative infrastructure.

Our role depends on the data. ThingsBoard, Inc. acts as the data controller for the personal data described in this Policy — Portal accounts, licensing, billing and customer records, website and support interactions, and the system and license data described in Section 2.3 — under applicable global data protection laws, including the EU General Data Protection Regulation (GDPR) and applicable US state privacy legislation.

Where a customer’s ThingsBoard deployment contains personal data, for example data about its users and its customers, we process this data only on the customer’s instructions to supply our services. For this data, the customer is the controller and we are a processor. Examples are data in our cloud services and data that a deployment sends to the ThingsBoard AI service (Section 5). Our agreement with the customer, including any data processing agreement, applies to this processing. This Policy does not apply to it.

This Policy applies to visitors, account holders, customers, developers, and representatives of Organizations utilizing ThingsBoard products, services, or web platforms. Our products, website, and Portal are intended for business and professional use and are not directed to children under 16; we do not knowingly collect personal data from children.

2. Information We Collect

We collect information directly from you, automatically through your interactions with our platforms, and from third-party services.

2.1 Information Provided Directly by You

• Account and Registration Information: When you register for a ThingsBoard account, sign up for the Portal, request a software license key, or participate in the Community Grant Program, we collect personal identity and professional details, including your full name, business email address, corporate entity/Organization name, country, phone number, and account authentication credentials (passwords or security tokens).
• Commercial and Licensing Data: Records of licenses requested, generated, assigned, or deleted; commercial declarations submitted (including non-commercial operational status, device allocations, and organizational identity); and records of communications with our sales, compliance, or support teams.
• Support and Inquiry Data: Information provided during customer support interactions, technical inquiries, sales inquiries, or community forum participation.

2.2 Payment and Billing Data

What Stripe handles. We do not collect, process or store payment instruments — card numbers, bank credentials or equivalent. All card transactions made through the Portal or our website are collected, processed and secured by our payment processor, Stripe, Inc. (“Stripe”), under its own privacy policy. Stripe returns to us only transaction confirmations, billing addresses, Tax/VAT IDs and payment status.

What we hold ourselves. We maintain our own billing and customer records, in our accounting system (Intuit Inc., QuickBooks) and our customer relationship management system (Pipedrive). These records include your legal entity name and billing address, Tax/VAT ID, the name, business email address and telephone number of your billing and account contacts, purchase order numbers, invoices and credit notes, amounts, currency, dates, payment status and payment history, and correspondence relating to your purchases and account.

We keep these records to perform our contract with you, to meet our accounting and tax obligations, and to manage our relationship with your organization. Retention is described in Section 6.

2.3 System, License Check, and Instance Check Data

When you utilize our Software, license keys, or the Portal, we collect technical operational data:

• Standard License Validation Data: Under a standard online license, the Software periodically contacts our license server. Each request carries your license secret, instance ID, and cluster ID, and our servers record the connecting source IP address for license-compliance and abuse-protection purposes. Some requests also include a usage snapshot: aggregate, platform-wide metrics such as packaging type and database backend, software version, entity counts (e.g., tenants, devices, assets, users), feature-mix breakdowns (e.g., rule node types, integration types, solution templates), database size, and previous-day hourly API/message volumes (e.g., messages, emails, SMS, data points). The snapshot is pseudonymous and attributable to your licensed account, but never contains message payloads, telemetry values, user names, credentials, or customer-authored scripts. You may disable the snapshot by setting the environment variable TB_ANONYMOUS_USAGE_REPORTING=false in the Software’s configuration, without affecting platform functionality, license validity, or support entitlements; license validation requests and IP recording continue. The specific counters may evolve; the collecting code is available in the source-available distribution. Offline (air-gapped) licenses are validated entirely within your deployment against the signed license data issued to you; such instances send no validation requests or usage snapshots to our license server.
• Instance Check Reports: If your Organization registers for or maintains a license under the Community Grant Program, you generate and submit an Instance Check Report. To size and verify your Community Grant, you run the verification tool against your own deployment. The tool operates locally under your control and opens the database read-only, and produces a single encrypted report. When you proceed with a license grant, the tool uploads the report automatically. Where your deployment has no outbound connectivity, the tool cannot upload it, and you transfer and submit the report through the Portal yourself. Submitted reports are retained as described below in this Privacy Policy.
  • What it contains: solely operational and structural metadata, installation and enrollment identifiers, software and tool versions, collection timestamps, earliest-activity dates, entity counts and creation-interval statistics, processing-node counts, storage-size and row-count estimates, two PostgreSQL server markers (the age of the database transaction counter and the server start time), statistical checks that the deployment’s recorded history is genuine, and reliability markers.
  • What it NEVER contains: telemetry or attribute values, entity names or descriptions, host or node names, credentials, message payloads, dashboard or rule chain contents, or personal data.
• Update Server Communications: Separately from licensing, the Software contacts our update server (updates.thingsboard.io) in the ways described below; in each case our servers record the connecting source IP address for license-compliance and abuse-protection purposes.
  • Release update checks. Unless disabled in the Software’s configuration, each core node periodically checks for newer ThingsBoard releases and the matching ThingsBoard Edge version, sending only the installed software version, packaging type, and a randomly generated local installation identifier not linked to your account or license. As part of the same check, it retrieves the published version and upgrade maps for ThingsBoard Edge and the ThingsBoard remote agent; these requests send no data. This applies to all installations regardless of license type and can be disabled without affecting platform functionality or license validity.
  • Agent application template versions. When application template synchronization for remote agents is enabled (the default), each core node periodically retrieves the published version maps for ThingsBoard Edge and ThingsBoard IoT Gateway to prepare version-specific deployment templates. These requests send no installation, account, or license data. This synchronization is configured independently of release update checks and can be disabled or pointed at a different server; when disabled, version-specific application templates for remote agents are not available.
  • Offline license check-in. Instances under an offline license also attempt a short identity check-in at startup and approximately hourly from every node. Without outbound connectivity these attempts fail silently and have no effect on the license or platform. A successful check-in transmits only your customer identifier and subscription identifier as recorded in the offline license, plus the packaging type and licensing component version — no usage counters, telemetry, configuration, or personal data of your users. We use it to confirm the license is in active use and to detect use beyond its scope (e.g., in additional, separate deployments). As an essential anti-abuse and intellectual property protection control, it cannot be disabled within the product.
• Public Repository Synchronization: By default, the Software periodically downloads content from public ThingsBoard repositories hosted on GitHub (github.com): remote agent application templates, IoT Gateway management dashboards, and the integration data converter library. These are read-only downloads that send no installation, account, license, or user data; the connections are made to GitHub, not to our servers, and are subject to GitHub’s own privacy terms. Each source can be disabled or pointed at your own mirror in the Software’s configuration. Separately, the web UI may request the ThingsBoard repository’s public star count from the GitHub API directly from the user’s browser; no ThingsBoard data is sent.

2.4 Website Usage, Cookies, and Tracking Technologies

When visiting our websites or Portal, we automatically collect log data and technical information, including your IP address, browser type, operating system, referring URLs, access times, pages viewed, and device parameters. We utilize essential cookies for authentication and platform security, as well as analytics cookies (where consented to) to measure platform usage and performance.

Website (thingsboard.io). When you visit our website, our hosting provider (Cloudflare) receives your IP address and basic browser data so that the page can load, and we receive the pages you view, the page that referred you and your browser and device details. Analytics and advertising measurement cookies are set only after you consent in our cookie banner, and you can change your choice at any time under “Your Privacy Choices” in the site footer. The cookies and similar technologies we use on our website, and how to manage them, are described in our Cookie Policy.

If you arrive through a link with campaign tags (utm) or a partner referral code (fpr) and you allow Marketing cookies, we store them in your browser and add them to the forms you submit and to the ThingsBoard Cloud and License Portal sign-up links you follow, so that we know which campaign or partner brought you. When you submit a form on our website, we receive what you enter and the page you sent it from, and, if you allowed the relevant cookies, those campaign tags, the partner code, and the Google Analytics identifier of your browser, so that we can connect your request with how you found us.

Our website support chat is an AI assistant provided by YourGPT; it loads only when you click the chat button, and its answers are generated automatically. Site search is provided by Google Programmable Search Engine and loads only after you allow External media in the cookie banner or press “Load Google search” on the search page; Google then sets its own cookies and may show ads in the results. Some pages embed videos from YouTube: until you play a video, the page shows only a preview image from our own domain; when you play it, YouTube (Google) receives your IP address and our domain and sets cookies on its own domain, under the Google Privacy Policy.

Do Not Track and Global Privacy Control. Our website does not change its behaviour in response to browser “Do Not Track” signals. If your browser sends a Global Privacy Control signal, we treat it as a refusal of Marketing cookies. Analytics and advertising measurement cookies are set only with your consent in the cookie banner, and you can withdraw that consent at any time under “Your Privacy Choices” in the site footer. When you consent, Google, Microsoft, LinkedIn and Meta may collect information about your activity on our website over time and across other websites, as described in our Cookie Policy.

2.5 ThingsBoard AI Feature Interactions

The ThingsBoard AI service uses an AI model (a large language model) to read the user’s messages and to write the responses. Section 4 names the provider of the AI model.

We process the following categories of data (together, “AI data”) only when a user invokes a ThingsBoard AI feature:

• Conversation Content: Messages users type, the AI model’s responses, the session context, the platform data retrieved for the model (both described below), conversation titles, and the resulting conversation history.
• Session Context: The platform view and entity the user is working with, the current dashboard state, the user’s time zone, and the interface language.
• Platform Data: To answer a query, the AI model may request additional data from the platform. Data requested this way may include any platform data the requesting user is permitted to access through the ThingsBoard API, including personal data held in that deployment, such as details of platform users and of the customers within it, and device credentials.
• Account and Service Identifiers: ThingsBoard user and tenant identifiers and, for self-hosted deployments, the Organization’s Portal account and license subscription identifiers.
• Usage Counters: AI credits consumed per billing period, per tenant on ThingsBoard Cloud or per license subscription for self-hosted deployments.
• AI Audit Records: A per-request record of the conversation content together with token and credit counts, processing times, error details, the web address (URL) of the originating ThingsBoard instance, and, for ThingsBoard Cloud accounts, the user’s email address.
• Diagnostic Logs: Request metadata, identifiers, and error diagnostics.

2.6 Business Contact and Prospect Data

We also hold business contact records for people who have not purchased from us — for example, someone who requests a demonstration or a quotation, registers for a webinar or event, subscribes to updates, or otherwise contacts our sales team. These records are kept in our customer relationship management system (Pipedrive) and typically comprise name, business email address, telephone number, employer, role, country, the source of the enquiry, and our correspondence about it.

We process this data on the basis of our legitimate interests in developing and managing business relationships. You may object at any time under Section 8, and every marketing email carries an unsubscribe link. Where we rely on consent for electronic marketing, you may withdraw it at any time, without affecting processing carried out before withdrawal.

3. Legal Bases and Purposes of Processing

We process personal data only where we have a valid legal basis under applicable law:

4. Third-Party Data Sharing and Processing

ThingsBoard does not sell, rent, or trade your personal data. Advertising measurement tags on our website that may count as “sharing” under relevant law run only if you allow Marketing cookies; you can opt out at any time under “Your Privacy Choices” in the site footer, and we honor the Global Privacy Control signal. With Analytics consent only, Google Analytics sends cookieless, non-personalised measurement signals to Google Ads, as described in our Cookie Policy. We share personal and technical data strictly as necessary for administrative and legal purposes:

• Service Providers and Processors: We engage trusted third-party service providers to execute business operations, including Stripe, Inc. (payment processing), Intuit Inc. (accounting and invoicing — QuickBooks), Pipedrive (customer relationship management), cloud infrastructure hosting providers, and customer communication tools. These service providers process data strictly on our instructions and under confidentiality and data protection agreements.
• AI Service Providers: The ThingsBoard AI service, operated by ThingsBoard, Inc. and described in Section 5, relies on the following providers to deliver AI features. Google LLC (Gemini API): Conversation content is processed via Google’s paid Gemini API, which provides the AI model that generates the responses. Tavily, Inc.: Search queries composed by the AI model are transmitted to Tavily to perform web searches. No platform identity data or user credentials are sent to Tavily.
• Corporate Transactions: In the event of a merger, acquisition, corporate reorganization, asset sale, or bankruptcy involving ThingsBoard, Inc., personal and organizational account data may be transferred to the acquiring or surviving entity subject to standard privacy obligations.
• Legal and Regulatory Disclosures: We may disclose personal data where required to do so by applicable law, court order, subpoena, government inquiry, or to protect the safety, legal rights, or property of ThingsBoard, Inc., our users, or the public.
• Website Tools: Our public website uses or may use Google LLC (Google Analytics, Google Tag Manager, Google Ads, the Programmable Search Engine that powers our site search and YouTube for embedded videos) and Microsoft Corporation (Microsoft Clarity) to measure how the site is used, including session recordings and heatmaps of page interactions, LinkedIn Corporation and Meta Platforms, Inc. advertising tags, Cloudflare, Inc. for content delivery and protection against automated traffic, Formspree, Inc. (contact forms and documentation feedback), MailerLite, Inc. (newsletter and demo requests), FirstPromoter (affiliate program attribution) and Delta4 Infotech Pvt. Ltd. (YourGPT) for the AI support chat; these tools set cookies or store data on your device only as described in our Cookie Policy, which also explains how to opt out. For Google Ads conversion measurement, the site search and the embedded YouTube videos, Google LLC acts as an independent controller under the Google Privacy Policy. Each provider’s privacy policy is available on its website; the links for the website tools are listed in our Cookie Policy.

5. International Data Transfers

ThingsBoard, Inc. is a United States corporation. Personal data collected from users located outside the US (including the European Economic Area (EEA), the United Kingdom, and Switzerland) is transferred to, stored, and processed in the United States and other regions where ThingsBoard or its subprocessors operate.

AI features on ThingsBoard Cloud and in self-hosted deployments alike are provided by the ThingsBoard AI service, operated by ThingsBoard, Inc. That service receives the data described in Section 2.5 and stores conversation history and AI audit records in the customer’s ThingsBoard Cloud region or, for self-hosted deployments, in the European Union.

To protect cross-border transfers of personal data originating from the EEA, UK, or Switzerland, ThingsBoard relies on legally recognized transfer mechanisms, including:

• Standard Contractual Clauses (SCCs): Execution of the European Commission’s Standard Contractual Clauses (and UK Addendum) for transfers to data controllers or data processors in third countries lacking an adequacy decision.
• Supplementary Measures: Supplementary technical, organizational, and contractual measures designed to ensure a level of data protection equivalent to European Union standards.
• EU-U.S. Data Privacy Framework: Where a provider in the United States is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, we rely on that certification.

The providers behind our public website are located in the United States (Google, Microsoft, LinkedIn, Meta, Cloudflare, MailerLite, Formspree) and India (YourGPT). You can request a copy of the safeguards we use for a transfer by writing to privacy@thingsboard.io.

6. Retention, Account Deletion, and Post-Deletion Evidentiary Rules

6.1 Standard Account Retention

We retain personal data associated with active user or Organization accounts for as long as the account remains open, as needed to fulfill contractual obligations, or as required by applicable tax, accounting, and legal recordkeeping regulations.

6.2 Voluntary Account Deletion

You may request or execute the deletion of your user or Organization account at any time within the Portal settings or by contacting privacy operations. Upon execution of an account deletion request, ThingsBoard permanently deletes your personal identity data—including your name, personal email address, login credentials, and direct links connecting your identity to system records.

If your Organization operates the Software under an offline (air-gapped) license, our automated cloud systems cannot detect when a user is deleted locally within your infrastructure. Consequently, local deletions do not automatically trigger a deletion of associated account data held centrally by ThingsBoard. To exercise a deletion of data held by ThingsBoard, the user or Organization representative must manually submit a deletion request to privacy@thingsboard.io, providing information sufficient for us to locate the data, such as an account or subscription ID.

6.3 Technical Data and License Evidence Retained After Account Deletion

Pursuant to Article 17(3)(e) of the GDPR (and equivalent statutory exemptions permitting retention necessary for the establishment, exercise, or defense of legal claims):

• License & Deployment Records: Technical instance identifiers (instance IDs and cluster IDs), generated license keys, commercial declarations, and uploaded Instance Check Reports are retained after account deletion for the period defined below.
• Delinking Mechanics: Prior to retention, all such technical records are irreversibly delinked from your personal account details (name, personal email, direct credentials).
• Evidentiary Purpose: These records constitute objective evidence of the legal licensing status of a specific software deployment and the declarations behind perpetual or granted permissions. ThingsBoard maintains these technical records for as long as the underlying license grant, software deployment, or potential legal claim exists.
• Billing and Accounting Records: Invoices, credit notes, payment records and the company and contact details they carry are retained for the period required by applicable tax and accounting law — generally seven (7) years from the end of the relevant financial year — including after account deletion. These records are not delinked, because tax law requires the customer to remain identifiable on them.

6.4 Suspected Violation & Integrity Retention

Where an account or deployment is linked to an ongoing investigation or suspected violation of our LICENSE terms, License Agreement, Community Grant License Agreement, or Portal Terms at the time of account deletion, ThingsBoard reserves the right to retain a minimal, privacy-preserving cryptographic record (a one-way hashed identifier) tied to the historical deployment or identity. This hashed record is retained strictly for the purpose of establishing, exercising, or defending against legal claims, preventing fraudulent re-registration, and enforcing retroactive commercial license compliance under GDPR Article 17(3)(e).

6.5 AI Feature Data

Conversation history and AI audit records (see Section 2.5) are retained for as long as the account they belong to remains active and are deleted automatically when the conversation, user account, or tenant they belong to is deleted. Where our systems cannot detect such a deletion, they are kept for no longer than twenty-four (24) months and may be deleted earlier on request.

• Automatic Deletion: When a user deletes a conversation, or a user account or tenant is deleted on the platform, the ThingsBoard AI service is notified and immediately and permanently deletes the corresponding conversations and AI audit records, or removes the user’s identifiers from records that belong to the Organization’s shared work.
• Inactivity: Independently of the above, conversation history and AI audit records are automatically and permanently deleted after twenty-four (24) months without AI activity. On ThingsBoard Cloud this is assessed per user; for self-hosted deployments it is assessed for the Organization’s Portal account as a whole.
• Deletions We Cannot Detect: If a user or tenant is deleted in a deployment that cannot reach our systems, such as an offline (air-gapped) deployment, the deletion is not detected and the data remains until the inactivity rule applies. In that case, or at any other time, you may request deletion as described in Section 6.2.
• Evidentiary Carve-Out: Where specific AI records are needed to resolve a billing dispute, investigate abuse, or establish, exercise, or defend legal claims (Art. 17(3)(e) GDPR), we may retain them, with the user’s account identifiers removed, for no longer than twenty-four (24) months.
• Diagnostic Logs: Diagnostic logs are retained for ten (10) days and then automatically deleted.

6.6 Business Contact and Prospect Data

Where an enquiry does not lead to a purchase, we keep the contact record described in Section 2.6 for as long as the enquiry remains a realistic business prospect. We judge that by whether there has been meaningful interaction — a reply, a meeting, a quotation, or a renewed enquiry — and we delete or anonymize records that no longer meet it when we review our records. You may ask us to delete your record, or object to the processing, at any time under Section 8, and we will act on that request.

6.7 Website Data

• Google Analytics: event and user data is retained for 14 months.
• Microsoft Clarity: session recordings are retained for 30 days and heatmaps and dashboard data for 13 months.
• Newsletter: your email address is kept until you unsubscribe, and no longer than 24 months after your last interaction with us. After you unsubscribe, we keep it on a suppression list so that we do not mail you again.
• Demo requests held by our email provider: until you unsubscribe, and no longer than 24 months after your last interaction with us; the copy in our CRM follows Section 6.6.
• Form submissions held by our form provider are deleted after 12 months; the copy in our CRM follows Section 6.6.
• Website support chat: conversations are retained by our chat provider for 30 days and then deleted.
• Campaign tags and partner code in your browser: until you withdraw your Marketing consent, it expires after 180 days, or you clear your browser data.
• Your cookie choice: 180 days.

7. Data Security

ThingsBoard maintains appropriate administrative, physical, and technical safeguards designed to protect personal data against accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure, or access.

• Encryption: Instance Check Reports, authentication tokens, Portal communications, and all AI-related communications are transmitted using industry-standard TLS/SSL encryption.
• Payment Isolation: Direct payment card processing is isolated and handled exclusively by Stripe. We do not receive or store payment card details.
• Access Control: Access to personal data is restricted to authorized ThingsBoard personnel and contractors who require access to execute administrative, compliance, or support tasks under binding confidentiality agreements.

8. Your Data Subject Rights

Depending on your jurisdiction (including the EEA, UK, Canada, and various US states), you may hold statutory rights regarding your personal data:

• Right to Access / Know: Request confirmation of whether we process your personal data and obtain a copy of such data.
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated personal data.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data, subject to the retention exemptions outlined in Section 6.
• Right to Restrict or Object to Processing: Object to processing based on legitimate interests or request restrictions on specific processing activities. For online licenses, you may disable the collection and transmission of usage snapshot statistics at any time by setting the relevant parameter in your environment configuration. Disabling usage statistics does not affect platform functionality, license validity, or support entitlements, but it does not disable standard license-validation checks or the recording of connecting source IP addresses for anti-abuse and security purposes. AI features can likewise be disabled by administrators system-wide, per tenant, or per user role; when disabled, no AI data is collected or sent.
• Right to Data Portability: Receive a structured, commonly used, and machine-readable copy of personal data provided under contract or consent.
• Right to Withdraw Consent: Where processing is based on consent, withdraw your consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: Lodge a complaint with your local Data Protection Authority (DPA) or regulatory body.

To exercise any applicable right, please submit a written request to privacy@thingsboard.io. We will respond within statutory timeframes upon verifying your identity and legal authority.

9. Amendments to This Privacy Policy

ThingsBoard reserves the right to modify or update this Privacy Policy periodically to reflect technological changes, legal requirements, or adjustments to our business practices. The updated Policy will be published on our website and Portal with a revised “Revision Date”. In the event of material structural or legal changes, registered account holders will be notified via email to the primary address associated with their Organization account prior to the effective date.

10. Contact Information

For inquiries, legal notices, or requests regarding this Privacy Policy or our data protection practices, please contact our privacy team at: privacy@thingsboard.io.