Privacy Policy

For account and billing data, Thaelior is the data controller. For data about website visitors processed through the agent, our customer is the controller and Thaelior acts as their processor — handling that data on their behalf. If you’re a visitor with a question about your data, please contact the website operator you were chatting with.

Account & profile. Your name, email address, country, and language preference, plus optional company and phone if you add them during onboarding. If you upload a profile photo, we store a resized copy (without the original file’s metadata, such as location) and show it only to you and the people in your workspace; you can remove it at any time in your profile settings.

Billing. Payments are processed by Stripe. We don’t store your full card details — we keep identifiers (such as your Stripe customer and subscription IDs) and plan status needed to manage your subscription.

Your knowledge base. The content you add for your agent to use — pages, files, and Q&A — and the data your use of the service generates.

Support requests. When you write to us from your dashboard, we keep your messages, the images you attach (re-encoded, without their original metadata) and our replies in your account, so you can follow the conversation. When you use Chat with us, your messages and our AI assistant’s replies are kept with Thaelior’s own conversations, linked to your account, so our team can see what led to a ticket. They are deleted with your account. When you write to us through the contact forms on our website (Get help, Talk to sales), we keep what you send — your name, email address, message and, for sales, any company or phone you add — so our team can answer you by email.

Visitor & conversation data. Messages exchanged with the agent, the visitor’s language, technical details such as browser/device information (user agent), and a one-way hashed form of the visitor’s IP address (we don’t store raw IP addresses). When a visitor shares contact details, those are captured as a lead and delivered to the relevant customer. Depending on how the customer has set up their agent, a visitor may be asked for their name and email address (and, if the customer chooses, a phone number) before being connected to a member of the customer’s team, or in a contact form when no one is available. When a live chat with the customer’s team ends, the visitor may rate it Good or Bad and add a comment; the customer’s team sees the rating and the comment with that conversation.

Usage & technical data. Logs, message counts, and similar operational data used to run and secure the service.

Cookies. We use only essential cookies — to keep you signed in. We don’t use advertising or cross-site tracking cookies.

Spam protection. Our sign-up, sign-in, password-reset and contact forms use Google reCAPTCHA to tell people from automated spam. Its script runs on those pages only, collects information about your device and browser and how you use the page (such as your IP address), and sets one cookie it needs for this check (_GRECAPTCHA).

• to provide and operate the service, including generating answers from your content;
• to authenticate you, send verification and password-reset codes, and secure accounts;
• to process payments and manage subscriptions;
• to send service and lifecycle emails (such as billing and usage notices);
• to provide support and respond to your requests;
• to monitor, maintain, and improve the service and prevent abuse;
• to meet legal and regulatory obligations.

To answer a visitor’s question, the question and the relevant parts of your knowledge base are sent to our AI provider (OpenAI) to generate a response and to create the embeddings that power retrieval. Under our API terms with that provider, this content is not used to train their models.

We share data only as needed with providers that help us run the service:

• OpenAI — AI processing (generating answers and embeddings);
• Stripe — payment processing and billing;
• Resend — delivery of transactional and lifecycle emails;
• Google (reCAPTCHA) — spam protection on our sign-up, sign-in, password-reset and contact forms;
• Hostinger — hosting and infrastructure.

We don’t sell personal data. We may also disclose data where required by law, to protect rights and safety, or as part of a business transfer (such as a merger or acquisition).

• Account and billing data is kept while your account is active and for a reasonable period afterward, plus any period required by law.
• Browsable conversation transcripts are automatically pruned after a window that depends on your plan (for example, 90 days on the free plan and longer on paid plans). You can also delete a conversation yourself at any time from your dashboard.
• Aggregate analytics that don’t identify individual visitors may be retained beyond that window.

Depending on where you live, you may have the right to access, correct, delete, export, or object to the processing of your personal data. To exercise these rights for your account, contact us at the address below. If you’re a visitor, please contact the website operator you interacted with — as the controller, they direct how that data is handled, and we’ll assist them as their processor.

Some of our providers operate in other countries, including the United States, so your data may be transferred and processed there. Where the law requires, we rely on appropriate safeguards for these transfers.

We protect data with measures including encryption in transit, hashed account passwords, hashed visitor IP addresses, and access controls. No method of transmission or storage is completely secure, so we can’t guarantee absolute security.

Thaelior isn’t directed to children, and we don’t knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we’ll delete it.

We may update this policy from time to time. We’ll update the date above and, for material changes, provide additional notice where appropriate.

For privacy questions or to exercise your rights, contact us at privacy@thaelior.com. The data controller is Icequia Ltd, registered in England and Wales, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. See also our Terms of Service.