Private assistant infrastructure should be understandable.

Personal Information And Product Data We Handle

Thalovant may collect or process account identifiers, contact details, login and security records, workspace settings, public hub metadata, private hub configuration, client specifications, API and integration settings, BYOS configuration, prompts, assistant responses, billing posture, support messages, device and browser signals, consent preferences, and operational telemetry needed to run the service.

Do not publish personal, confidential, sensitive, regulated, or third-party information in a public hub unless you have authority to make it public. Private hubs and workspaces are designed for scoped access, but users remain responsible for what they connect, upload, publish, or route through the service.

Why We Use It

Thalovant uses information to provide and secure accounts, route assistant activity, operate public and private hubs, connect clients and APIs, preserve workspace context, apply access controls, support BYOS workflows, process billing, provide support, investigate abuse, improve reliability, maintain telemetry, and comply with legal obligations.

Website analytics are optional. If allowed, analytics help Thalovant understand aggregate website usage, product interest, and reliability without being used for advertising on the public website.

Consent, Choices, And Visibility

Thalovant asks for consent where required and tries to make choices understandable at the moment they matter. You can use the footer Cookie settings control to accept or reject optional analytics. You can choose whether a hub is public or private in the product surfaces that control publishing.

You may withdraw consent where the law allows, but some information is required to provide accounts, security, billing, private workspace operation, abuse prevention, or legally required records. If a withdrawal prevents Thalovant from providing a feature, that feature may need to be disabled.

Public Surfaces, Service Providers, And Transfers

Public hubs are intended to be discoverable and may be visible globally. Private hubs, workspace configuration, ACL posture, billing posture, and operational telemetry are intended to remain scoped to authorized users, Thalovant operations, and service providers that need access to perform their role.

Thalovant may use providers for hosting, authentication, payment processing, analytics when consented, support, monitoring, security, email, and infrastructure operations. Providers may process information outside Quebec or Canada. Thalovant should use contractual and technical safeguards and, where Quebec law requires it, assess cross-border privacy factors before transferring personal information.

Quebec And Canada Privacy Rights

Depending on where you live and how you use Thalovant, you may have rights to access personal information, request correction, withdraw consent, ask questions about processing, request deletion or de-indexing where applicable, receive information about automated decisions where applicable, and obtain portability when the legal requirement applies.

Send privacy requests to privacy@thalovant.com. Thalovant may need to verify your identity, workspace authority, and the scope of the request. You may also contact the Office of the Privacy Commissioner of Canada or the Commission d'acces a l'information du Quebec if you have unresolved concerns.

Safeguards, Retention, And Incidents

Thalovant is designed around scoped access, workspace ownership, protected sign-ins, private hub boundaries, cookie consent, and telemetry that helps users understand what happened without hiding the operating context.

Operational records may be retained to keep the service reliable, support auditability, investigate abuse, process billing, comply with legal obligations, and understand product health. Retention periods vary by data type, plan, workspace configuration, backup cycle, legal obligation, and operational need.

If Thalovant identifies a confidentiality or security incident involving personal information, Thalovant should investigate, contain, document the incident, and notify affected users or regulators where legally required.

Children, Automation, And Review

Thalovant is not intended for children under 13. The public website does not use analytics to make decisions with legal or similarly significant effects. If product automation introduces such decision-making, Thalovant should disclose the relevant logic, factors, and review path where required.

This privacy policy should be reviewed periodically as Thalovant adds paid plans, enterprise deployments, new providers, new data flows, or French-language Quebec legal pages.