Thalovant Privacy Notice

1. Who is responsible

1.1 Controller. Thalovant Technologies Inc., 2727 rue Saint-Patrick, Montréal, Quebec H3K 0A8, Canada, is the controller of the personal information described in this notice (except as explained in 1.3).

1.2 Privacy officer. Our person in charge of the protection of personal information (Privacy Officer) can be reached at privacy@thalovant.com or by mail at the address above, marked "Attention: Privacy Officer".

1.3 When an organisation is responsible. When you talk to a hub operated by an organisation on a Work plan (for example, in a library, shop or office), that organisation decides how your information is used and is the controller. We process the information on its behalf under our Data Processing Agreement. Please read that organisation's privacy information and send your requests to it; we will help it respond.

1.4 EU representative. We have not appointed a representative in the European Union under article 27 of the GDPR yet; we will name them here. Until then, people in the European Union can contact us directly at privacy@thalovant.com. People in the United Kingdom can contact us directly at privacy@thalovant.com.

2. What we collect

We do not collect voiceprints or other biometric identifiers, and we do not try to identify who is speaking. We do not ask for, and you should not give hubs, sensitive information such as health data, government identification numbers or financial account numbers.

3. Why we use it and our legal bases

The GDPR requires us to state a legal basis for each purpose. Canadian law requires us to identify our purposes and obtain your consent where needed; using the Services for the purposes below is the consent you give when you create an account, and you can withdraw consent as described in section 8.

AI training. We do not use your utterance text or memory items to train or fine-tune AI models.

Automated decisions. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Automated safety filters may stop a hub from answering certain requests; you can contact us to have a person review such an outcome.

Crisis referrals. Every hub checks what is said for explicit statements about suicide, self-harm or immediate danger and, when it finds one, answers with a fixed referral to emergency and crisis lines (see section 4 of the AI & Safety page). The hub then reports the referral directly to our service, and we record it as an event named "crisis_referral_shown": the type of referral, the audience (children's or general wording), its language and the time, linked to the hub, device and session, with the country last seen for the device's connection when we know it. It contains no text. When we receive it, we store the referral, and the same device's activity from the 30 seconds before it, without text or IP address and with no location finer than a country, even on hubs that otherwise keep utterance text. We keep these records for 30 days; after that we keep only a count of referrals per country, audience and day, for 400 days, with no hub, device, account or session attached. Two copies are outside this and expire under their normal retention in section 4: the hub's short-term conversation journal (not kept on kid-labelled hubs and kids' profiles) and security and request logs. A hub owner watching live activity at that moment may already have seen the words. We use these records to check that referrals work.

4. How long we keep it

Backups are overwritten on a rolling cycle; deleted data disappears from backups when they are overwritten. When we no longer need information, we delete it or anonymise it.

5. Who we share it with

5.1 Subprocessors. We use a small number of service providers to run the Services, listed with their purpose and location on the Subprocessors page: Cloudflare (edge network, security and email routing), Stripe (payments), Google (website analytics, only with your consent) and GitHub (software downloads). They may use the information only to provide their services to us.

5.2 Stripe as merchant of record. When Stripe acts as merchant of record for your purchase, it receives your payment and billing information as an independent controller, and its privacy policy applies to that information.

5.3 People you choose. Information you share with a hub is visible to that hub's owner. On the Family plan, the other adult can see the shared hubs and their history. In an organisation's workspace, its administrators can see the hubs, history and settings they manage. When you use a public hub, the organisation that publishes it is responsible for what you tell it.

5.4 Legal requests. We disclose information to public authorities only when the law requires it or to protect someone from serious harm. Where lawful, we tell you before we do.

5.5 Business changes. If our business is reorganised, merged or sold, information may be transferred to the new owner, who must continue to protect it as described here.

5.6 No sale, no advertising. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use it for targeted advertising.

6. Where it is processed

6.1 Canada. Thalovant is based in Montreal, and our hubs and AI models run on our own hardware in Montreal, Quebec, Canada. The European Commission recognises that Canada provides an adequate level of protection for personal data received by organisations subject to PIPEDA; the UK and Switzerland recognise Canada in the same way.

6.2 Other countries. Some subprocessors process information in the United States or through a global edge network. For transfers from the EU, UK and Switzerland, we rely on the provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or on the European Commission's Standard Contractual Clauses. Before we communicate personal information outside Quebec, we assess whether it will receive adequate protection, as Quebec law requires.

6.3 No third-party AI. Your conversations are not sent to any US or other third-party AI provider. The speech recognition built into your phone, which the Android app uses, is a service of your phone's platform rather than of Thalovant; see section 11.2.

7. How we protect it

We protect personal information with measures appropriate to its sensitivity, including encryption in transit, access controls and logging for staff access, separation between customers, and minimising what we keep (no raw audio, short retention for text). No system is perfectly secure. If a confidentiality incident creates a risk of serious injury or a high risk to you, we notify you and the competent authorities as the law requires. Report security issues to security@thalovant.com.

8. Your rights

8.1 Everyone. Whatever your location, you can: see your memory items and utterance history and delete them in the dashboard; export your hub settings and memory; close your account; opt out of product news through the link in every such email; and turn analytics off with "Cookie settings" at the bottom of every page.

8.2 EU, EEA, UK and Switzerland (GDPR). You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including processing based on legitimate interests), to data portability, and to withdraw consent at any time without affecting earlier processing. You can complain to the data protection authority in the country where you live or work, or where you think an infringement occurred. In the UK, that is the Information Commissioner's Office.

8.3 Quebec (Law 25). You have the right to access and correct your personal information, to withdraw your consent, to ask us to stop disseminating your information or to de-index any hyperlink attached to your name that gives access to it, where the law allows, to receive computerised personal information you provided in a structured, commonly used technological format, and to be informed of the personal information used to make a decision based exclusively on automated processing (we make none). You can complain to the Commission d'accès à l'information du Québec.

8.4 Canada (PIPEDA). You can access and ask us to correct your personal information and withdraw consent, subject to legal and contractual restrictions. You can complain to the Office of the Privacy Commissioner of Canada.

8.5 United States. Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas or Oregon), you may have the right to know what personal information we collect, use and disclose, to access and receive a copy of it, to correct it, to delete it, and to opt out of its sale, of its sharing for targeted advertising, and of profiling. We do not sell or share personal information and do not profile you in ways that produce legal or similarly significant effects. We do not discriminate against you for exercising your rights. If we deny your request, you can appeal by replying to our decision; if we deny your appeal, we tell you how to contact your state attorney general. California residents may also ask how we disclose personal information for direct marketing; we do not disclose it to third parties for their direct marketing.

8.6 How to make a request. Email privacy@thalovant.com or write to the Privacy Officer at the address in section 1. We may need to verify your identity, and we will answer within the time the law requires (for example 30 days in Quebec and under PIPEDA, one month under the GDPR, and 45 days under the CCPA, which can be extended as the law allows). You may use an authorised agent where your law allows. Requests are free unless they are manifestly unfounded or excessive.

9. Children

9.1 Adults-only accounts. Accounts are for adults (18 or older). Children cannot create accounts.

9.2 Kid-labelled hubs and the Family kids' profile. Children use Thalovant only through a kid-labelled hub or, on the Family plan, a kids' profile set up by a parent or guardian. On these, we keep no utterance text, no IP address, no memory and no conversation journal. The kids' profile has memory turned off. Audio is used only to convert speech into text to answer, and is deleted immediately. The parent or guardian can see and delete the profile's settings and remove the profile at any time.

9.3 COPPA statement (United States). Thalovant is not directed to children under 13, and we do not knowingly collect personal information from children under 13 other than audio used only as a replacement for written words and deleted immediately, as described in 9.2. A parent or guardian creates any kids' profile and controls it. If you believe a child under 13 has given us personal information (for example, by creating an account), contact privacy@thalovant.com and we will delete it.

9.4 Organisations. Organisations that let children use hubs in their places must use kid-labelled hubs, as required by our Business Terms.

10. Voice assistants in shared spaces

A hub hears the people around it. If you own a hub, tell the people who use it or may be heard by it that it is an AI assistant and, on paid plans, that the text of what they say can be kept for up to 90 days. Organisations running hubs in their places must display signage and obtain any consent the law requires, as set out in our Business Terms.

11. Voice apps

11.1 The Android app. The Thalovant Android app (package com.thalovant.voice) lets you talk to your own Thalovant hub from your phone. Other Thalovant voice clients connect to a hub you choose and are covered by the rest of this notice.

11.2 Wake word and speech. Listening for the wake word ("Hey Jarvis") happens entirely on the phone, and no audio leaves the phone before the wake word is heard. After the wake word, or when you tap to talk, your speech is converted to text by the speech recognition service built into Android on your phone. That service is part of your phone's platform, not a Thalovant service: on many phones it is Google's, which may process audio on its servers under its own privacy terms. The text of your request is sent to your Thalovant hub, and answers may be spoken by Android's text-to-speech engine on the phone. Typed questions are sent to the hub as text.

11.3 Location. If you allow it, the app sends the approximate location the phone already knows, together with your time zone, with each question so that answers such as the weather can be local. The app uses the phone's last known approximate position, does not request a fresh GPS fix, and discards a position older than 24 hours. You can refuse or revoke location access in Android settings, and the app still works without it.

11.4 Sign-in and credentials. You sign in through your browser at dash.thalovant.com. The app receives a short-lived, narrowly scoped token, uses it once to create the phone's connection to the hub you choose, and then revokes it. The phone stores its hub connection credentials encrypted on the device, using Android Keystore-backed storage. The name Android gives the phone, such as "Galaxy S24", is registered as the connection's name.

11.5 Microphone, camera and notifications. While Keep listening is on, the app runs a foreground service with a notification, and Android shows its microphone-in-use indicator. The camera is used only to scan a setup QR code on the device; images are not stored or sent. The app contains no advertising and no third-party analytics SDKs.

11.6 Unpairing and deletion. Unpairing in the app removes the hub connection credentials from the phone. You can delete your account and its data at dash.thalovant.com/profile using Delete account. As with the rest of Thalovant, accounts are for adults (see section 9).

12. Cookies, Do Not Track and Global Privacy Control

12.1 Cookies. Our Cookie Policy lists the browser storage we use. Analytics runs only if you allow it.

12.2 Do Not Track (California Online Privacy Protection Act). Our website does not change its behaviour in response to "Do Not Track" browser signals, because there is no common standard for them. We do not track you across third-party websites, we do not allow third parties to collect information about your online activities over time and across websites through our Services for advertising, and we use analytics only with your consent.

12.3 Global Privacy Control. Because we do not sell or share personal information for targeted advertising, a Global Privacy Control signal does not change how we process your information; you can turn analytics off at any time with "Cookie settings".

13. Changes and contact

We update this notice when our practices change. If a change materially affects how we use personal information you have already given us, we tell you in advance by email or in the dashboard and, where the law requires, ask for your consent. Earlier versions are available on request.

Questions or requests: privacy@thalovant.com, or the Privacy Officer, Thalovant Technologies Inc., 2727 rue Saint-Patrick, Montréal, Quebec H3K 0A8, Canada.