Loading…
Effective date: September 15, 2026
This DPA forms part of the Terms of Service and governs ThothOS’s processing of personal data on behalf of a client company (the controller) whose employees’, contacts’ and customers’ data ThothOS stores.
The client company is the data controller: it determines the purposes and means of processing the personal data it submits. ThothOS is the data processor and processes that data only on the controller’s documented instructions — which include this DPA, the Terms of Service, and the controller’s own use of the Service.
Identity and contact data; employee records; CRM contact data; authentication and credential data; appointment and booking data; lead-capture data including submitter IP; commerce and order data including Stripe payment references but no raw card data; loyalty, wishlist, review and contract data; and audit/access-log metadata including IP, user-agent and coarse geography. The full inventory is in the Privacy Policy.
The Service is not designed for special-category data. It is general business software, and we do not hold ourselves out as a HIPAA business associate; do not place protected health information in it without agreeing separate terms with us first.
The Service is business software sold to companies. It is not directed at children under 13, and we do not knowingly collect personal data from a child under 13. If you believe a child under 13 has provided personal data through a company’s use of the Service, contact us and we will delete it.
ThothOS will:
The controller authorizes ThothOS to engage the sub-processors listed on our Sub-processor page. We impose data-protection obligations on each sub-processor substantially equivalent to those in this DPA, and we remain responsible to you for a sub-processor’s performance of those obligations.
We will give you at least 30 days’ notice before a new sub-processor begins processing your data, by updating our Sub-processor page and notifying the billing contact on your account. You may object on reasonable data-protection grounds during that period; if we cannot resolve your objection, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the unused term.
Our security measures are described in Annex 2 and on our Security page.
If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and in any case within 72 hours of becoming aware of it, with the information we have at the time — what happened, which categories of data and roughly how many records are affected, what we are doing about it, and how to reach us. We will follow up as we learn more rather than waiting until the picture is complete.
Customer Data is stored and processed in the United States. We do not offer regional data-residency options, and we do not operate a European or United Kingdom storage region. If you are subject to a law that requires personal data to stay within another jurisdiction, the Service is not suitable for that data. Our sub-processors may process data in the United States on our behalf as described on the Sub-processor page.
You may cancel at any time from the Billing tab in your dashboard. We may suspend or terminate access for material breach of these Terms, or for use prohibited by our Acceptable Use Policy. After cancellation your data remains available for export, and your account remains restorable by resubscribing, for 30 days; after that window it is permanently deleted through a dependency-ordered cascade across our data stores, as described in the Privacy Policy. Export is self-service and stays available for the whole window — you do not need to ask us to unlock it.
Per-category retention windows — audit logs, change history, security records, API usage — are published in the retention schedule in our Privacy Policy. That schedule is generated from the retention configuration the platform enforces, so the published window and the enforced window are the same window.
The Service provides self-service export (access and portability) and deletion (erasure, with lawful retention of certain transaction and security records as described in the retention schedule). Where a controller cannot fulfil a request itself, ThothOS will assist.
On reasonable written notice and no more than once a year — or after a breach affecting your data — we will make available the information necessary to demonstrate compliance with this DPA, and will respond to a reasonable security questionnaire. Where a controller requires an on-premises inspection, the parties will agree scope, timing, and cost in advance, and it may not disrupt the Service or expose another customer’s data.
In this section, Customer Data means everything you and your end users put into your tenant — the personal data described in section 4, together with the business records, documents and configuration that surround it. It is the whole of what the guarantee below protects, not a subset of it.
ThothOS does not use Customer Data to train, fine-tune, or otherwise improve any machine-learning or AI model. AI features are powered by third-party model providers acting as sub-processors under agreements that prohibit training on data submitted through their API; prompts and generated outputs are processed transiently to serve your request and are not retained for model training.
The model providers acting as sub-processors for these features are named on the Sub-processor page. The half of the sentence above that is a fact about OUR code — which providers are called, and whether every one of them is disclosed to you — is checked by a build gate on every change. The half that is a fact about a provider’s own contract with us is exactly that: a contractual commitment we hold them to, not something our software can verify.
This DPA is subject to the limitation of liability, term, and governing-law provisions of the Terms of Service. Where this DPA and the Terms conflict on the processing of personal data, this DPA controls.
Privacy and security matters, including a suspected breach, reach us at security@thothos.net.
The measures below are the SAME control statements published on our Security page and Trust Center — rendered from one source, not restated here. That matters for an annex: a security schedule attached to a contract is the version a counterparty relies on, and a hand-copied one drifts from the page the moment a control is hedged or strengthened. Each statement below carries its own evidence and its own limits in the words it is published in — this paragraph deliberately makes no claim of its own about them, because a summary sentence over a control list is exactly the shape that rounds a hedge up into a promise.
tests/playwright/role-matrix/), and a cross-tenant isolation guard suite runs in CI. Counts and pass/fail are taken from the live suite — not a hand-typed marketing number.