Thalus Privacy Policy
Last updated: 15 June 2026
We at Thalus (“Thalus”, “we”, “us”, “our”) respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website (the “Site”), including but not limited to: Our main landing page, related forms, and marketing sections, Careers and About Us pages, Privacy & Cookie Policy, and Terms of Service pages.
Please read this Privacy Policy carefully. By accessing the Site on behalf of an organization or in a professional capacity, you acknowledge that you have reviewed and understood this Privacy Policy.
1. Who we are
Thalus is an enterprise technology company that helps organizations bring structure, clarity, and confidence to AI risk management and governance. Our platform supports businesses developing, deploying, or operating AI systems by automating risk classification, detecting governance and privacy risks, and recommending practical controls aligned with applicable laws, standards, and frameworks.
We deliver our services through an API-first platform designed to plug neatly into existing SDLC, governance, and compliance tools—so teams can govern AI responsibly without slowing development. Our solutions support compliance efforts under frameworks such as the EU Artificial Intelligence Act, GDPR, ISO 42001, and the NIST AI Risk Management Framework.
This Privacy Policy explains how Thalus collects, uses, and protects information in connection with our website, enterprise platform, APIs, and related services when accessed by business users and authorized representatives acting on behalf of an organization.
If you have any questions about this Privacy Policy or our data practices, you can contact us at:
Email: admin@thalus.ai
2. Scope of this Privacy Policy
This Privacy Policy applies to information we collect:
When you visit or browse our website pages, including the landing page, Careers, About Us, Privacy Policy, Cookie Policy, and Terms of Service.
When you interact with our “Request a demo” form or other contact forms.
When you interact with our “See how it works” or “Login/Enterprise Login” buttons.
Through our privacy-friendly web analytics tool.
It does not apply to:
Any separate web application or customer dashboard you access after logging in (these may be governed by a separate agreement/policy);
The Services may be used in regulated industries, including healthcare and life sciences, but are intended solely to support internal governance and risk assessment activities, do not constitute legal or regulatory advice or independently ensure compliance (including GxP or patient safety requirements), and any outputs are informational only, with enterprise customers retaining responsibility for suitability, controls, and oversight.
Data submitted or generated by enterprise customers through the Services (“Customer Data”) is controlled by the applicable customer, and Thalus processes such data in its capacity as a service provider or data processor, as reasonably necessary to provide, secure, and maintain the Services.
Customer Data is typically provided by enterprise customers in an anonymized, aggregated, or otherwise de-identified form to enable the Services. Thalus does not determine the purposes for which such data is collected, has no direct relationship with individuals whose information may be reflected in Customer Data, and is not responsible for its accuracy, legality, content, or the privacy practices of customers or third-party systems they control.
3. Information we collect
3.1 Information you provide to us
We may collect information that you voluntarily provide in the course of interacting with the Site or communicating with us, when you interact with the Site, for example:
Request a demo form
Required:
Email address
Optional:
Name
Organization / Company name
Contact or inquiry forms (if present)
Name
Email address
Organization / role
Any information you choose to include in your message
Careers / job interest (if applicable)
Basic details you provide through a careers form (e.g., name, email, role of interest) and any CV or cover letter you upload or send via email.
You do not have to provide this information, but if you choose not to, we may not be able to respond to your request (for example, we cannot schedule a demo without a way to contact you).
3.2 Information collected automatically (analytics and logs)
When you visit our Site, we collect certain information automatically in the ordinary course of operating the Site to understand how visitors use our pages and to ensure the availability, security, integrity and reliability of our services. This may include, but not limited to:
URL of pages visited on our Site
Date and time of visit
Referrer (the site or source that brought you to us, if available)
General location (country or region)
Device type, operating system, and browser type/version
Approximate time spent on page
We use Umami Cloud, a privacy-friendly analytics service designed to operate without cookies and without collecting or storing personally identifiable information such as email addresses in analytics payloads. Umami measures overall traffic trends using aggregated and anonymous statistics and does not use cross-site tracking or ad-tech profiling. After you sign in, we may associate product usage with a pseudonymous account identifier to understand activation funnels.
We may also maintain standard server logs and security logs, for legitimate business purposes, including security monitoring, error diagnosis, system administration, abuse prevention, compliance with applicable legal obligations, and operational purposes (e.g., to detect abuse or attacks). Such logs may be retained for limited periods as reasonably necessary for these purposes.
3.3 Cookies and similar technologies
Our marketing site is designed ****not to use third-party tracking cookies commonly used for advertising purposes.
Our analytics provider, Umami Cloud, operates without cookies for analytics measurement. After sign-in, product analytics may use a pseudonymous identifier to stitch sessions for funnel analysis.
If we provide a login or user account area, the application may use strictly necessary cookies (e.g., session cookies) as reasonably required to authenticate users, maintain sessions/to keep you logged in, and secure your account. These cookies are essential to the functioning of the service and cannot be disabled without affecting performance.
If we materially change, introduce additional cookies or similar technologies in the future, we will update this Privacy Policy and, where required by applicable law, provide appropriate notice and consent or preference options.
4. How we use your information
We use the information we collect as reasonably necessary for the following purposes:
To respond to your requests and provide services
Responding to “Request a demo” submissions
Scheduling and conducting demo calls or product walkthroughs
Answering questions or inquiries you submit via forms or email, or other communications you initiate
To operate, maintain, and improve our Site
Monitoring and analyzing aggregated usage, engagement, and traffic patterns
Improving our content, navigation, and user experience
Ensuring the availability, security, and reliability of the Site
To communicate with you
Sending you confirmations, updates, and other transactional or service-related messages about your demo request or inquiry
Where permitted by applicable law and subject to your preferences, and/or where you have provided consent (if required), sending you occasional product or feature updates, newsletters, or marketing communications that may be of interest (you may opt out at any time)
To comply with legal obligations
Responding to lawful and valid requests from public authorities
Meeting applicable legal, tax, and accounting obligations
To protect our rights and interests
Detecting, preventing, and responding to abuse, fraud, or security incidents
Enforcing our Terms of Service and other applicable agreements, and protecting the rights, property, or safety of Thalus and others
5. Legal bases for processing (EEA/UK visitors)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under one or more of the following legal bases:
Performance of a contract (Art. 6(1)(b) GDPR):
When we process your information to respond to your demo request, provide services you requested, or take steps at your request before entering into a contract.
Legitimate interests (Art. 6(1)(f) GDPR):
For example, to analyze and improve our Site, maintain security, and respond to basic inquiries, provided these interests are not overridden by your rights and interests.
Consent (Art. 6(1)(a) GDPR):
When we use your information for optional activities such as sending certain marketing communications where consent is required. You can withdraw your consent at any time.
Compliance with legal obligations (Art. 6(1)(c) GDPR):
When we process data to comply with laws, regulations, or legal processes.
6. How we share your information
We do not sell your personal information.
We may share your information on a limited basis with the following categories of recipients:
Trusted third-party providers who help us operate and improve our Site or services, such as:
Email delivery services
Scheduling or meeting tools (for demos)
These providers may process your personal data in connection with providing services to us and are contractually required to use such data only as necessary to perform their services and to protect it in accordance with applicable confidentiality and data protection obligations.
Whenever we share your data with third parties, we take reasonable and appropriate measures to ensure appropriate data protection and confidentiality.
7. International data transfers
Depending on where you are located and where our service providers operate, your information may be processed in countries outside your own.
We aim to use providers that implement appropriate safeguards (for example, standard contractual clauses approved by the European Commission for EEA data, or equivalent mechanisms).
Our analytics provider, Umami Cloud, stores website analytics data on servers located in the European Union and is built with privacy regulations such as GDPR and CCPA in mind.
Where required by law, we will implement additional measures to protect your information when it is transferred across borders.
8. Data retention
We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected or otherwise processed, including:
As long as needed to manage demo requests, follow-up conversations, and potential customer relationships and related business relationship evaluation or onboarding activities
As necessary to comply with applicable laws, regulations, or contractual obligations
For a limited period, thereafter, as reasonably necessary to maintain business records, resolve disputes, investigate or prevent fraud or misuse, or enforce our agreements and policies
When information is no longer needed, we will take reasonable steps to either delete it, anonymize it, or aggregate it so that it no longer identifies, or can reasonably be used to identify, an individual, unless retention is required or permitted by law.
9. Your rights
Depending on your location and applicable law, you may have some or all of the following rights regarding your personal information, subject to applicable legal limitations and exceptions:
Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to request that we correct inaccurate or incomplete data.
Right to erasure – to request deletion of your personal data in certain circumstances and where permitted by law.
Right to restriction of processing – to request that we limit how we use your data in specific situations provided by law.
Right to data portability – to receive your data in a structured, commonly used format and to transmit it to another controller, where technically feasible.
Right to object – to object to certain processing activities, including where processing is based on our legitimate interests, subject to compelling legitimate grounds.
Right to withdraw consent – where processing is based on consent, you can withdraw that consent at any time, without affecting the lawfulness of processing prior to withdrawal.
To exercise your rights, please contact us at admin@thalus.ai.
We may request additional information as reasonably necessary to verify your identity and to process your request.
We will acknowledge and respond to verified requests within a reasonable period and, in any event, within thirty (30) to sixty (60) days, as permitted under applicable law. Where allowed, this period may be extended if the request is complex or numerous, in which case we will inform you of the extension.
If you are in the EEA or UK and you believe we have not handled your data correctly, you also have the right to lodge a complaint with your local data protection authority.
10. Security
We take reasonable and appropriate administrative, technical, and organizational measures designed to protect your personal information against unauthorized access, loss, misuse, or alteration, taking into account the nature of the information and the risks involved.
However, no security safeguards are infallible, and no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your information, we do not warrant or guarantee that such information will be absolutely secure.
11. Children’s privacy
Our Site is not intended for children under the age of 16 (or a higher age where required by local law). We do not knowingly collect personal information from children.
If you are a parent or guardian and believe that your child has provided us with personal information, please contact us so we can take appropriate steps to remove it.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time in our discretion to reflect changes in our practices, technologies, business operations or legal requirements.
When we make material changes, we will update the “Last updated” date at the top of this page and, where required by applicable law or otherwise deemed appropriate, provide additional notice (such as a banner or email notification).
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
13. Contact us
Questions, clarifications, or privacy-related curiosities? We’re happy to help.
If you have any questions, concerns, or requests about this Privacy Policy or how we handle data, you can reach us at:
Thalus – Privacy Contact
Email: admin@thalus.ai
Address: [Insert company address]