Privacy Policy

1. Information we collect

Website visitors

We collect your IP address, browser, pages viewed, referring site, and approximate location through cookies from Google Tag Manager and Google Analytics. We also collect anything you send us when you request a demo or contact us.

Account holders

• Account details: name, work email, company, role, and login details. Clerk handles passwords, and we never see them.
• Billing details: billing contact and address. Stripe collects and stores card details. We see only the card type, last four digits, and expiration date.
• Usage and technical data: log-ins, feature usage, device data, errors, and security logs.
• Communications: support requests and feedback.

2. What we do not collect or access

• We do not sell, rent, broker, or trade personal information or Customer Data.
• We do not use Customer Data to train or fine-tune AI models. Our AI providers are prohibited by contract or account setting from training on it.
• T.HESIS personnel do not view Customer Data except when technically necessary to run, secure, or support the Service, when the law requires it, or with the customer's written permission. Any such access is logged.
• We do not use Customer Data for advertising or marketing.

3. How we use information

We use information to:

• provide, secure, and support the Service;
• manage accounts and payments;
• send service messages, such as invites, security alerts, trial reminders, receipts, and policy changes;
• respond to your requests;
• understand usage in aggregate;
• send business marketing, which you can opt out of; and
• prevent fraud and comply with the law.

4. Subprocessors

We share information only with providers who help run the Service, under contracts that limit how they can use it.

We will give [30] days' notice before we add a subprocessor that processes Customer Data. We may also disclose information when the law requires it, to protect rights and safety, or to a successor that agrees to honor this policy.

5. AI processing

When you use AI features, the relevant document text, deal information, and your question go to one of the AI providers above so it can produce a response. None of these providers may train its models on that information. Some providers may keep it for a short time to prevent abuse. We use each provider's zero or limited retention settings where they are available.

6. Retention

• Account information: for the life of the account, plus up to [2] years.
• Billing records: [7] years.
• Customer Data: until the customer deletes it, or 30 days after cancellation. It is then deleted from active systems within [30] days and from backups within [90] days.
• AI monitoring logs: we keep metadata such as the model used, token counts, and timing, for [30] days. We do not keep the text of your prompts or responses in these logs.
• Website analytics: [14] months.

7. Security

Our safeguards include:

• access controls and role-based permissions;
• multi-factor authentication for administrators;
• HTTPS with HSTS;
• encryption at rest by our providers, including AES-256 at Cloudinary;
• private document storage with links that expire after 5 minutes;
• tenant separation checked on every request;
• rate limiting; and
• audit logs.

No system is perfectly secure. We do not currently hold a SOC 2 or ISO 27001 report. To report a security concern, email drobertson@thesisportal.com directly.

8. Security incidents

If we confirm a breach that affects Customer Data, we will notify account administrators within 72 hours of confirmation and cooperate with any notices you must give. For personal information we control, we will notify individuals and regulators as the law requires, including within 45 days under Arizona law (A.R.S. 18-552).

9. Your choices and rights

• Update your account information in Settings or by contacting us.
• Unsubscribe from marketing at any time.
• Block cookies in your browser. Some features need essential cookies to work.
• Depending on where you live, you may ask to access, correct, delete, or receive a copy of your information, and to appeal our decision. Email privacy@thesisportal.com. We respond within 45 days.
• If your information is part of a customer's Customer Data, we will refer your request to that customer and help them respond.
• We will not discriminate against you for exercising your rights.

10. Cookies

• Essential cookies handle sign-in and security. They are set by Clerk and by our app, including a cookie that identifies invited data room guests.
• Analytics cookies come from Google Analytics, loaded through Google Tag Manager.
• We do not use advertising cookies. We do not sell or share data for cross-context behavioral advertising. [Confirm Google signals and ad-linking are off.]

11. Children

The Service is for business use and is not directed to anyone under 18.

12. International users

Our providers process data in the United States [and other countries where they operate]. If you use the Service from outside the United States, your information is transferred to the United States.

13. Changes to this policy

We will notify administrators by email at least 30 days before material changes.

14. Contact

T.HESIS AI, Inc.
[MAILING ADDRESS]
privacy@thesisportal.com
[PHONE, optional]