Trust
Trust & Compliance
A short map of how Thalovant handles data, safety and security, with links to the detailed terms and practices, subject to their stated draft status.
Data
| Question | Answer |
|---|---|
| Where do hubs and AI models run? | On Thalovant-operated hardware in Montreal, Quebec, Canada. |
| Is audio stored? | Thalovant does not store raw audio on its servers. The desktop app can keep the latest 40 recordings on your device if you enable "Keep the last recordings"; see the EULA, section 5.2. The phone apps do not send audio to Thalovant, but phone speech providers and Siri process it under their own terms; see the Privacy Notice, section 11. |
| Is anyone identified by their voice? | No. We do not perform speaker identification or create voiceprints. |
| How long is utterance text kept? | Up to 90 days on paid hubs you own. Not kept for the Free plan, anonymous or preview sessions, or kid-labelled hubs. |
| Who controls memory? | You can ask a hub to remember or forget an item, or manage it in the dashboard. Deleting an item stops its use by hubs, but deleted items, expired items and earlier versions remain in your account and export until account deletion. Memory is disabled for teen accounts, kid-labelled hubs and kids' profiles. See the Privacy Notice, section 2. |
| Which service providers are used? | Cloudflare, Stripe, Google Analytics (with consent) and GitHub are listed on Subprocessors. Phone-platform services, Siri and media-stream recipients are also described in the Privacy Notice, section 11; the subprocessor list is not a list of every independent service a device can contact. |
Details: Privacy Notice, Cookie Policy, Data Processing Agreement.
Safety
Hubs disclose that they are AI. The AI & Safety page lists crisis lines and how to report a concern, and explains how every hub answers explicit statements about suicide, self-harm or immediate danger with a fixed referral to crisis lines (keyword detection, not clinical screening). Accounts are for people aged 13 and over (14 and over in Quebec). Younger children use kid-labelled hubs or a Family kids' profile under a parent or guardian's account, as described in the Privacy Notice, section 9. Those features keep no utterance text or IP address in conversation activity, and no memory or conversation journal. This does not mean that no personal information is processed: account and device identifiers, security records and linked crisis-referral records are described separately in the Privacy Notice. Teen accounts also have memory and their hubs' conversation journals disabled. The Acceptable Use Policy forbids recording people without consent and relying on AI for medical, legal or emergency decisions.
Public hubs and skills
Every public hub, on every plan, is reviewed by Thalovant before it is listed. Skills that play YouTube, YouTube Music, Spotify, SoundCloud or Bandcamp content are not offered in the store for licensing reasons. See the Publisher Terms.
Security
Access to production systems is limited and logged, traffic is encrypted in transit, and customers are separated from one another. The technical and organisational measures are listed in Annex 2 of the Data Processing Agreement. Report vulnerabilities to security@thalovant.com; please do not test against other users' accounts or data.
Certifications
Thalovant does not currently hold SOC 2, ISO/IEC 27001, HIPAA, PCI DSS (as a merchant, payments are handled by Stripe) or FedRAMP certification or attestation. Organisations that need security questionnaires, procurement review or contractual commitments can contact support@thalovant.com.
Legal documents
| Document | For |
|---|---|
| Terms of Service | Households on Free, Home and Family |
| Business Terms | Organisations on Work plans |
| Data Processing Agreement | Organisations on Work plans |
| Publisher Terms | Anyone publishing a public hub or skill |
| End User Licence Agreement | Users of the Thalovant Voice desktop app and satellite software |
| Acceptable Use Policy | Everyone |
| Right of Withdrawal | Consumers in the EU, EEA, UK and Switzerland |
| Privacy Notice | Everyone: how we handle personal information |
| Privacy rights by region | Everyone: what we collect and keep, and your rights in Canada, Quebec, other provinces and the United States |
| Delete your account and data | Everyone: how to delete an account, signed in or not, and what is kept |
| Cookie Policy | Visitors of thalovant.com, docs.thalovant.com, dash.thalovant.com (including Explore and Showroom), and status.thalovant.com |
| AI & Safety | Everyone: how the assistant discloses it is an AI, and what it does when someone is in danger |
| Subprocessors | Organisations on Work plans, and anyone checking who processes data |
| Imprint | Who operates Thalovant |
Version 2026-10-01. Available in English and French. Applicable language rights are preserved. Version française. Questions: support@thalovant.com.