Thalovant Privacy Notice

1. Who is responsible

1.1 Controller. Thalovant Technologies Inc., 2727 rue Saint-Patrick, Montréal, Quebec H3K 0A8, Canada, is the controller of the personal information described in this notice (except as explained in 1.3).

1.2 Privacy officer. Our person in charge of the protection of personal information (Privacy Officer) can be reached at privacy@thalovant.com or by mail at the address above, marked "Attention: Privacy Officer".

1.3 When an organisation is responsible. When you talk to a hub operated by an organisation on a Work plan (for example, in a library, shop or office), that organisation decides how your information is used and is the controller. We process the information on its behalf under our Data Processing Agreement. Please read that organisation's privacy information and send your requests to it; we will help it respond.

1.4 EU representative. We have not appointed a representative in the European Union under article 27 of the GDPR yet; we will name them here. Until then, people in the European Union can contact us directly at privacy@thalovant.com. People in the United Kingdom can contact us directly at privacy@thalovant.com.

2. What we collect

We do not collect voiceprints or other biometric identifiers, and we do not try to identify who is speaking. We do not ask for, and you should not give hubs, sensitive information such as health data, government identification numbers or financial account numbers.

Personal memory. A hub remembers something for you only when you ask it to, in English or French (for example "remember that my sister's name is Ana"), or when you add it in the dashboard. Each memory item is kept by us, linked to your account rather than to a device or a hub. Your own paired devices hear it read back on any reviewed public hub that offers memory, including public hubs published by other organisations; other people's devices do not. On a private hub whose owner has connected memory to their own account, everyone who talks to that hub hears, and can add to, that owner's memory. Thalovant administrators can also see memory items. An adult Free account can keep one item: when you ask for a second, the hub offers to replace the first, and replaces it only if you say yes. Paid plans have no limit on the number of items. An item has no end date unless you set one in the dashboard. You can delete an item by asking the hub to forget it, or in the dashboard, and a hub stops using it within a minute. A deleted item, and an item past its end date, still stays in your account, under Deleted in the dashboard and in your data export, until your account is deleted; so do earlier versions of an item you changed in the dashboard. Memory is disabled for teen accounts, kid-labelled hubs and kids' profiles. Removing an item from active use is not permanent erasure; statutory erasure requests and obligations under an applicable DPA remain separate.

3. Why we use it and our legal bases

Where the GDPR applies, the table states a legal basis for each purpose. Canadian law requires identified purposes and meaningful consent where required, taking account of the information's sensitivity and the context. Creating an account, accepting the Terms or reading this notice is not blanket consent to every purpose listed below. Website analytics and product-news emails are optional; phone location requires your permission. Where processing relies on consent, you can withdraw it as described in section 8 and the relevant settings. A GDPR legal basis does not replace any consent required by Canadian or other applicable law.

AI training. We do not use your utterance text or memory items to train or fine-tune AI models.

Automated decisions. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Automated safety filters may stop a hub from answering certain requests; you can contact us to have a person review such an outcome.

Crisis referrals. Every hub checks what is said for explicit statements about suicide, self-harm or immediate danger and, when it finds one, answers with a fixed referral to emergency and crisis lines (see section 4 of the AI & Safety page). The hub then reports the referral directly to our service; if our service cannot be reached after three tries, that referral is not recorded. We record it as an event named "crisis_referral_shown": the type of referral, the audience (children's or general wording), its language and the time, linked to the hub, the device and its name, the session and the account the device belongs to, with the country of the device's latest recorded activity, when we have one. It contains no text. When we receive it, we remove the text, the IP address and any location finer than a country from the same device's activity in the same conversation, from 30 seconds before the referral to 5 seconds after it, in the activity records our service keeps, even on hubs that otherwise keep utterance text; activity that reaches us after the referral is stored without them. We keep these records for 30 days; after that we keep only a count of referrals per country, audience and day, for 400 days, with no hub, device, account or session attached. Some copies are outside this and expire under their normal retention in section 4: the hub's short-term conversation journal (not kept on kid-labelled hubs and kids' profiles), security and request logs, and what our live activity feed had already sent, or still holds among its most recent events, at that moment. A hub owner watching live activity at that moment may already have seen the words. We use these records to check that referrals work.

4. How long we keep it

Backups are overwritten on a rolling cycle; deleted data disappears from backups when they are overwritten. When we no longer need information, we delete it or anonymise it.

5. Who we share it with

5.1 Subprocessors. We use a small number of service providers to run the Services, listed with their purpose and location on the Subprocessors page: Cloudflare (edge network, security and email routing), Stripe (payments), Google (website analytics, only with your consent) and GitHub (software downloads). They may use the information only to provide their services to us.

5.2 Stripe as merchant of record. When Stripe acts as merchant of record for your purchase, it receives your payment and billing information as an independent controller, and its privacy policy applies to that information.

5.3 People you choose. Information you share with a hub is visible to that hub's owner. On the Family plan, the other adult can see the shared hubs and their history. In an organisation's workspace, its administrators can see the hubs, history and settings they manage. When you use a public hub, the organisation that publishes it is responsible for what you tell it.

5.4 Legal requests. We disclose information to public authorities only when the law requires it or to protect someone from serious harm. Where lawful, we tell you before we do.

5.5 Business changes. If our business is reorganised, merged or sold, information may be transferred to the new owner, who must continue to protect it as described here.

5.6 No sale, no advertising. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use it for targeted advertising.

6. Where it is processed

6.1 Canada. Thalovant is based in Montreal, and our hubs and AI models run on our own hardware in Montreal, Quebec, Canada. The European Commission recognises that Canada provides an adequate level of protection for personal data received by organisations subject to PIPEDA; the UK and Switzerland recognise Canada in the same way.

6.2 Other countries. Some subprocessors process information in the United States or through a global edge network. For transfers from the EU, UK and Switzerland, we rely on the provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or on the European Commission's Standard Contractual Clauses. Before we communicate personal information outside Quebec, we assess whether it will receive adequate protection, as Quebec law requires.

6.3 AI and phone-platform services. Apart from your phone's speech recognition and questions you choose to ask through Siri, we do not send your conversations to any US or other third-party AI provider. The speech recognition our phone apps use is a service of your phone's platform rather than of Thalovant: on many Android phones it is Google's, and on iPhone it is Apple's, and it may process your voice on that company's servers. On iPhone, questions you ask through Siri also go through Apple. See section 11.2.

7. How we protect it

We protect personal information with measures appropriate to its sensitivity, including encryption in transit, access controls and logging for staff access, separation between customers, and minimising what we keep (no raw audio, short retention for text). No system is perfectly secure. If a confidentiality incident creates a risk of serious injury or a high risk to you, we notify you and the competent authorities as the law requires. Report security issues to security@thalovant.com.

8. Your rights

8.1 Everyone. Whatever your location, you can: see your memory items and utterance history and delete them in the dashboard; export your hub settings and memory; close your account; opt out of product news through the link in every such email; and turn analytics off with "Cookie settings" at the bottom of every page. Regional rights, what we collect and how long we keep each kind of information are on Privacy rights by region.

8.2 EU, EEA, UK and Switzerland (GDPR). You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including processing based on legitimate interests), to data portability, and to withdraw consent at any time without affecting earlier processing. You can complain to the data protection authority in the country where you live or work, or where you think an infringement occurred. In the UK, that is the Information Commissioner's Office.

8.3 Quebec (Law 25). You have the right to access and correct your personal information, to withdraw your consent, to ask us to stop disseminating your information or to de-index any hyperlink attached to your name that gives access to it, where the law allows, to receive computerised personal information you provided in a structured, commonly used technological format, and to be informed of the personal information used to make a decision based exclusively on automated processing (we make none). You can complain to the Commission d'accès à l'information du Québec.

8.4 Canada (PIPEDA). You can access and ask us to correct your personal information and withdraw consent, subject to legal and contractual restrictions. You can complain to the Office of the Privacy Commissioner of Canada.

8.5 United States. Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas or Oregon), you may have the right to know what personal information we collect, use and disclose, to access and receive a copy of it, to correct it, to delete it, and to opt out of its sale, of its sharing for targeted advertising, and of profiling. We do not sell personal information or share it for targeted advertising, and do not profile you in ways that produce legal or similarly significant effects. Other disclosures are described in section 5. We do not discriminate against you for exercising your rights. If we deny your request, you can appeal by replying to our decision; if we deny your appeal, we tell you how to contact your state attorney general. California residents may also ask how we disclose personal information for direct marketing; we do not disclose it to third parties for their direct marketing.

8.6 How to make a request. Email privacy@thalovant.com or write to the Privacy Officer at the address in section 1. We may need to verify your identity, and we will answer within the time the law requires (for example 30 days in Quebec and under PIPEDA, one month under the GDPR, and 45 days under the CCPA, which can be extended as the law allows). You may use an authorised agent where your law allows. Requests are free unless they are manifestly unfounded or excessive.

9. Children

9.1 Accounts from age 13. Accounts are for people aged 13 and over, and in Quebec for people aged 14 and over. Children under 13 cannot create accounts, and in Quebec neither can anyone under 14. When you sign up we ask for the month and year you were born. We also ask where you live (country, then province, territory or state). We keep only whether you are under or over the age of majority where you live (18 in most places) and the place you chose, and we do not keep the date. For now new accounts are open to people in Canada and the United States. If your answer is below the minimum for your region, signup cannot be completed. A new Google or GitHub sign-in may create a provisional account before this check; a declined new signup is erased. The submitted birth month and year are not stored.

9.2 Kid-labelled hubs and the Family kids' profile. Children under 13 use Thalovant only through a kid-labelled hub or, on the Family plan, a kids' profile set up by a parent or guardian. Their conversation and activity records retain no utterance text or IP address, and these hubs and profiles keep no personal memory or conversation journal. The kids' profile has memory turned off. Audio received by Thalovant is used only to convert speech into text to answer, and is deleted immediately. These limits do not mean that no personal information is processed: hub, device and session identifiers, profile settings and linked crisis referral records can still be retained as described in sections 2 to 4. Account sign-in and security records are separate from minimised conversation records. The parent or guardian can see and delete the profile's settings and remove the profile at any time.

9.3 Children under 13 and COPPA (United States). Children under 13 cannot create their own accounts. The child-facing hubs and profiles in section 9.2 nevertheless require their own assessment under children's privacy law. Deleting audio immediately or having a parent create a profile does not, by itself, establish an exemption from COPPA or satisfy any requirement for direct notice and verifiable parental consent. Where required, those steps must precede the collection, use or disclosure of children's personal information. This notice does not represent that such a consent process has been verified. If you believe a child under 13 has given us personal information without the required permission (for example, by creating an account), contact privacy@thalovant.com and we will delete it.

9.4 Organisations. Organisations that let children use hubs in their places must use kid-labelled hubs, as required by our Business Terms.

9.5 Teens. By a teen we mean a person aged 13 or over who is under the age of majority where they live (18 in most places, 19 in some provinces and states, 21 in Mississippi). A teen needs a parent or guardian's permission to use Thalovant. We rely on the teen for that permission and do not check it. A teen's account is on the Free plan, and a parent or guardian buys and manages any paid plan. The Free plan keeps no utterance text (section 4). A teen's account also has memory turned off, and the hubs it owns keep no conversation journal. A teen who uses a hub that someone else owns is in the position section 5.3 describes for anyone using that hub.

10. Voice assistants in shared spaces

A hub hears the people around it. If you own a hub, tell the people who use it or may be heard by it that it is an AI assistant and, on paid plans, that the text of what they say can be kept for up to 90 days. Organisations running hubs in their places must display signage and obtain any consent the law requires, as set out in our Business Terms.

11. Voice apps

11.1 The phone apps. Thalovant has two phone apps, both called Thalovant: one for Android (package com.thalovant.voice) and one for iPhone. They let you talk to your own Thalovant hub from your phone. The Thalovant Voice desktop app and our satellite software are covered by the rest of this notice and by the End User Licence Agreement.

11.2 Wake word and speech. Both apps detect the wake word, "Hey Jarvis", entirely on the phone; audio is not transmitted for wake-word detection. The phrase is fixed in the phone apps; you cannot choose another one there. After the wake word, or when you tap to talk, your speech is turned into text by the speech recognition your phone provides, which is not a Thalovant service:

• On Android, it is the phone's speech service, on many phones Google's. The app asks it to work on the phone where it can; otherwise it may send the audio to its provider's servers, under that provider's privacy terms.
• On iPhone, it is Apple's speech recognition. It works on the iPhone when your language is installed there; otherwise Apple processes the audio on its servers, under Apple's privacy terms.

Both apps offer "Recognise speech on this phone only" in Settings. It is off by default. When you turn it on, the app uses on-device recognition only and refuses recognition if the phone or language cannot support it, rather than falling back to an online service. This setting controls recognition in the app, not questions you ask through Siri.

If you set a second language, the same recording is also recognised in that language. The text of your request is sent to your Thalovant hub; the apps never send your voice to Thalovant. Answers are spoken by your phone's own voice (Android's text-to-speech, or Apple's voices on iPhone, including your Personal Voice if you allow it). Typed questions are sent to the hub as text. When an answer plays a radio station or a news bulletin, your phone fetches it directly from the address the hub gives, so that service sees your phone's IP address. On iPhone you can also ask through Siri ("Ask Thalovant"): Siri hears your question and speaks the hub's answer, under Apple's terms. While history is on, the iPhone app also gives iOS the questions your hub answered so that Siri can suggest them; unpairing removes them.

11.3 Location. With each question, the app sends your time zone and whether your phone shows a 12- or 24-hour clock. If you allow location access, it also sends the location the phone already knows and the city, region and country it is in, so that answers such as the weather can be local. The phone finds the name of that place with its own map service, which on many Android phones is Google's and on iPhone is Apple's. Android gives the app approximate location only. Both apps round latitude and longitude to two decimal places before looking up the place name or sending the location to the hub; turning on Precise Location in iOS settings does not remove that rounding. The app uses the phone's last known position, does not ask for a fresh fix, and discards a position older than 24 hours. You can refuse or withdraw location access in your phone's settings, and the app still works without it.

11.4 Sign-in and credentials. You sign in through your browser at dash.thalovant.com. The app receives a narrowly scoped token, uses it only while it sets up the phone's connection to the hub you choose, and then revokes it; it never saves it on the phone. If revoking fails, for example because the phone loses its connection at that moment, the token stays valid until it expires, a year after it was issued. The phone stores its hub connection credentials encrypted on the device: in Android Keystore-backed storage on Android, and in the iPhone's Keychain, for that device only. They are not included in backups or transfers to a new phone. The connection uses the manufacturer's name and model on Android, and the model on iPhone, such as "iPhone 15 Pro", not the personal name you gave your phone. The sign-in token carries the same name in your account.

11.5 Microphone, camera, notifications and alarms. While Keep listening is on, the Android app runs a foreground service with a notification, and Android shows its microphone-in-use indicator; the iPhone app keeps the microphone open, iOS shows its microphone indicator, and a Live Activity shows the hub and a Stop listening button. The camera is used only to scan a setup QR code on the device; images are not stored or sent. The phone keeps a copy of the alarms and timers you set by voice so that it can ring them. The apps contain no advertising. Android 1.0.2 disables the third-party telemetry bundled with its wake-word library; this does not mean the library contains no telemetry code. The earlier Android 1.0.1 internal-testing build enabled that library's Microsoft telemetry. The audited iPhone 1.0.0 build uses a different library version, in which no third-party telemetry transmission was identified. Our servers still process the technical information described in sections 2 to 4, and browser sign-in pages use consent-based website analytics. If an app crashes, its crash report stays on the phone until you copy or share it; on iPhone, if you have chosen to share analytics with app developers, Apple also sends us crash logs. After you have used an app for a while, it may ask you once to rate it with Google Play's or the App Store's own rating window; what you write there goes to that store, not to us.

11.6 Unpairing and deletion. Unpairing in the app removes the hub connection credentials from the phone (on iPhone, also the Siri suggestions and the alarms it holds). The connection itself stays listed in the dashboard until it is removed there. You can delete your account and its data at dash.thalovant.com/profile using Delete account, or by email if you cannot sign in; the steps, what is erased and what we keep are on Delete your account and data. As with the rest of Thalovant, accounts are for people aged 13 and over (see section 9).

11.7 Reporting an answer. You can choose to report a wrong or harmful answer from either app. The report sends the reason, hub name and host, time, question, answer, any note you add, app version and build, and operating-system version to Thalovant. It does not send your account sign-in credentials, but the hub can be associated with its owner's account, and the text may identify you; the report is not guaranteed to be anonymous. We use it to investigate the answer and provide support, and send a copy to our support mailbox. A keyed hash derived from the network address helps limit abuse. The retention periods are in section 4. If the in-app report cannot be sent, the app can offer an email draft that you choose whether to send.

12. Cookies, Do Not Track and Global Privacy Control

12.1 Cookies. Our Cookie Policy lists the browser storage we use. Analytics runs only if you allow it.

12.2 Do Not Track (California Online Privacy Protection Act). Our website does not change its behaviour in response to "Do Not Track" browser signals, because there is no common standard for them. We do not track you across third-party websites, we do not allow third parties to collect information about your online activities over time and across websites through our Services for advertising, and we use analytics only with your consent.

12.3 Global Privacy Control. Because we do not sell or share personal information for targeted advertising, a Global Privacy Control signal does not change how we process your information; you can turn analytics off at any time with "Cookie settings".

13. Changes and contact

We update this notice when our practices change. If a change materially affects how we use personal information you have already given us, we tell you in advance by email or in the dashboard and, where the law requires, ask for your consent. Earlier versions are available on request.

Questions or requests: privacy@thalovant.com, or the Privacy Officer, Thalovant Technologies Inc., 2727 rue Saint-Patrick, Montréal, Quebec H3K 0A8, Canada.