Thira Inc. ("Thira," "we," "us") collects personal information from people who visit thira.com, ask about the product, apply for a job, or work for our customers, partners, and vendors. This policy explains what we collect, why, and your choices.
Personal data a customer puts into the Thira platform is handled under the customer's agreement and our Data Processing Addendum, not this policy. Section 1 explains the line.
1. SCOPE
This policy covers personal information Thira handles as a controller, meaning Thira decides why and how it is used: visitors to thira.com, people who request a demo or contact us, job applicants, and individual contacts at our customers, partners, suppliers, and investors.
It does not cover personal data a customer loads into or connects to the Thira platform. For that data the customer is the controller and Thira is the processor, and what Thira may do with it is fixed by the customer's Master Subscription Agreement, Data Processing Addendum, and the permissions, policies, and approval gates the customer configures. If you are an employee or end user of a customer, contact that customer about that data.
2. INFORMATION WE COLLECT
| Information | Examples | Where it comes from |
|---|---|---|
| Contact and business details | Examples: Name, work email, phone, job title, employer | Where it comes from: You, by form or email; your employer under our agreement with them; business contact databases and publicly available professional sources |
| Website and device data | Examples: IP address, browser and device type, pages viewed, referrer, approximate location from IP address | Where it comes from: Collected automatically when you use thira.com |
| Job applications | Examples: Resume, work history, education, references, work authorization confirmation | Where it comes from: You; recruiters or referrers you authorize |
| Billing and vendor records | Examples: Billing contacts, purchase orders, invoices, remittance details | Where it comes from: Your employer; our accounting systems |
| Correspondence | Examples: Sales, support, security, privacy, and legal messages, including what you tell us about your environment, use case, and timeline, and recordings or transcripts of calls where we tell you we are recording | Where it comes from: You, by email and on calls |
| Platform account records | Examples: Login identity, email address, organization membership, authentication events | Where it comes from: Your employer's identity provider, through our authentication provider |
We do not seek sensitive personal information (government identifiers, health data, financial account numbers, or similar) through this website or our business correspondence, and ask that you not send it to us.
3. HOW WE USE INFORMATION
For people in the EEA, the UK, and Switzerland, the right-hand column gives our legal basis.
| Purpose | Legal basis |
|---|---|
| Respond to demo requests and inquiries | Legal basis: Steps at your request before a contract; our legitimate interest in answering inquiries |
| Provide, administer, and secure platform access for customer users | Legal basis: Our contract with your employer; our legitimate interest in keeping the service secure |
| Operate and improve thira.com, including analytics | Legal basis: Consent, where required for non-essential cookies; otherwise our legitimate interest in understanding site use |
| Send product and company updates | Legal basis: Consent, where required; otherwise our legitimate interest in marketing to business contacts. You can unsubscribe from any message |
| Evaluate job applications | Legal basis: Steps before an employment contract; our legitimate interest in assessing candidates |
| Manage customer, partner, and supplier relationships, including billing | Legal basis: Performance of a contract; our legitimate interest in administering our business |
| Detect, investigate, and prevent fraud, abuse, and security incidents | Legal basis: Our legitimate interest in protecting Thira, our customers, and the public |
| Comply with law and enforce our agreements | Legal basis: Compliance with a legal obligation; our legitimate interest in establishing and defending legal claims |
We do not use this information to make automated decisions with legal or similarly significant effects on you.
4. HOW WE SHARE INFORMATION
We share personal information with:
- Service providers that run parts of our business: cloud hosting, authentication, email delivery, analytics, CRM, recruiting, payroll, and accounting. Each is bound by contract to use the information only to provide services to us.
- Professional advisors (lawyers, accountants, auditors, insurers) who need it to advise us.
- An acquirer or investor, in connection with a financing, merger, acquisition, or asset sale, subject to confidentiality obligations.
- Government authorities or other parties, where required by law or legal process, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Thira, our customers, or the public.
We do not sell personal information or share it for cross-context behavioral advertising, as those terms are used in US state privacy laws, and have not done so in the past twelve months.
5. AI MODELS AND CUSTOMER DATA
To generate results, the platform sends prompts, workflow context, and documents to third-party AI model providers. We engage them under enterprise terms that prohibit training on the content we submit and restrict retention to the short periods those terms permit for security and abuse monitoring. Our model providers and other sub-processors are listed in our Data Processing Addendum and available from legal@thira.com.
We do not use personal data in a customer's workflows to train or improve Thira's models. We use customer data for product improvement only after anonymizing and de-identifying it to a standard designed to prevent re-identification, consistent with NIST SP 800-188 and recital 26 of the GDPR, and we obtain the customer's separate prior written consent before using any personal data for that purpose.
We design these safeguards so that no model, output, or product improvement derived from a customer's data identifies that customer or exposes its business or confidential information. We do not sell customer data or transfer it to third parties for their own commercial use.
These are contractual commitments in the Master Subscription Agreement and Data Processing Addendum that govern every customer relationship, provided to customers and prospects on request. Information we collect under this policy (website, sales correspondence, job applications) is not used to train AI models.
6. INTERNATIONAL TRANSFERS
Thira is based in the United States, and we and our service providers store and process information here. If you are in the EEA, the United Kingdom, or Switzerland, your information is transferred to the United States under the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary measures where needed. Customers can execute those clauses in our Data Processing Addendum. You can request a copy of our transfer safeguards from legal@thira.com.
7. HOW LONG WE KEEP INFORMATION
| Information | Retention period |
|---|---|
| Demo requests and sales inquiries | Retention: 24 months after our last contact with you, unless you become a customer contact |
| Customer, partner, and supplier records, including contracts and invoices | Retention: 7 years after the relationship ends, for tax and audit purposes |
| Job applications | Retention: 12 months after a hiring decision, unless you ask us to keep you on file or law requires longer |
| Website and analytics data | Retention: Up to 14 months |
| Marketing contacts | Retention: Until you unsubscribe, then a minimal suppression record so we do not contact you again |
| Security and access logs | Retention: At least 12 months; longer where an investigation, a customer agreement, or law requires |
| Platform account records | Retention: Subscription term, then deleted on the schedule in the customer's agreement |
Where law requires longer retention, or we need information to establish, exercise, or defend a legal claim, we keep it for that period and no longer.
8. SECURITY
We maintain a written information security program with administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, logging, and incident response procedures. A current summary of our practices, independent assessments, and compliance status is at thira.com/trust, with more detail available on request from security@thira.com.
No system is completely secure. To report a vulnerability or security concern, write to security@thira.com.
9. YOUR PRIVACY RIGHTS
Depending on where you live, you may have the right to:
- access the personal information we hold about you and how we use and share it
- correct or delete your information, or receive a portable copy
- object to or restrict certain processing
- withdraw consent, without affecting prior processing
- opt out of the sale of personal information, sharing for cross-context behavioral advertising, and profiling with legal or similarly significant effects (we do none of these)
- not be treated differently for exercising these rights
How to exercise them. Write to privacy@thira.com with your name, the email address you use with us, and your request. We respond within 45 days (one month for GDPR and UK GDPR requests), and will tell you if we need longer and why.
Verifying your identity. We confirm who you are before acting, usually by matching what you tell us against what we hold, and may ask for more for sensitive requests. You may use an authorized agent; we will ask for written proof of authority.
Appeals. If we decline your request, reply with "Appeal" in the subject line. We will respond within 45 days with the outcome and reasons. If we decline, you may complain to your state attorney general.
Complaints. If you are in the EEA, the United Kingdom, or Switzerland, you may complain to your local data protection authority, though we would like the chance to address your concern first.
Data held in the platform. Send requests about data the platform holds for a customer to that customer, and we will assist them in responding.
10. COOKIES AND TRACKING TECHNOLOGIES
thira.com uses cookies and similar technologies. Essential cookies keep the site working (security, load balancing, preferences). Analytics cookies show which pages people visit and how they arrived, so we can improve the site.
Where the law requires, we ask for consent before setting non-essential cookies, and you can change your choice at any time. You can also block or delete cookies in your browser, though parts of the site may not work.
We treat a Global Privacy Control signal as a valid opt-out request where applicable law requires. We do not respond to browser "Do Not Track" signals, which have no agreed meaning; we honor Global Privacy Control as described above. We do not serve advertising on thira.com.
11. CHILDREN'S PRIVACY
The Thira platform and thira.com are directed to businesses, not children. We do not knowingly collect personal information from anyone under 16; if you believe a child has given us personal information, write to privacy@thira.com and we will delete it.
12. CHANGES TO THIS POLICY, AND HOW TO REACH US
We update this policy when our practices or the law change, and the date above shows the last update. We will post notice of material changes on this page and, where the law requires and we have your address, email you.
Questions, requests, and complaints about this policy go to privacy@thira.com. Security concerns go to security@thira.com, and legal notices and contract matters go to legal@thira.com.
Thira Inc. 2265 116th Ave NE, Bellevue, WA 98004, United States