Loading…
Effective date: September 15, 2026. Privacy and security contact: security@thothos.net.
This policy describes how ThothOS handles personal data in two distinct roles. For our own account holders — the people at a company that subscribes — we are the controller. For the data a subscribing company puts into its tenant about its employees, contacts, and its own customers, that company is the controller and we are the processor; our obligations in that role are in the DPA.
Account & identity data (name, email, phone, address), business records you enter (contacts, invoices, schedules, inventory, etc.), and usage/analytics data.
Personal identity data (email, phone, address) is encrypted at rest; all traffic is encrypted in transit; tenant data is isolated at the data layer. See our Security page. We are extending field-level encryption to the contact and address data captured through orders.
26 of the cookies below are strictly necessary and are set without asking, because the service you requested cannot be delivered without them: they keep you signed in, protect that sign-in session against forgery, carry you through a sign-up or account-recovery step, route your request to the right workspace, and record the cookie choice you made here (`_thoth_consent`, kept 180 days). Every one of them is named in the table, with what it holds and how long it lasts. None is used to profile you, and none is shared with a third party.
With your permission we also use the following categories:
Nothing in the categories above is loaded, set or sent before you choose. Third-party tags are not mounted, the _thoth_acq attribution cookie (kept 30 days) is not written, and our own servers do not forward analytics or conversion events to a third party, until you have accepted the matching category. You can accept, refuse, or withdraw a previous choice at any time using the controls on this page — withdrawing is as easy as giving, and it takes effect immediately, without a reload.
| Cookie | Permission | Set by | What it is for | Kept for |
|---|---|---|---|---|
_thoth_consent | Essential | ThothOS | stores the cookie choice you made on this site — which categories you accepted and when — so we do not have to ask again on every visit, and so we can show that the choice was actually made | 180 days |
logged_in | Essential | ThothOS | keeps you signed in after you have authenticated. There is one per user type so that, for example, an administrator session in one tab does not overwrite a customer session in another | 5 days |
logged_in_administrator | Essential | ThothOS | keeps you signed in after you have authenticated. There is one per user type so that, for example, an administrator session in one tab does not overwrite a customer session in another | 5 days |
logged_in_employee | Essential | ThothOS | keeps you signed in after you have authenticated. There is one per user type so that, for example, an administrator session in one tab does not overwrite a customer session in another | 5 days |
logged_in_customer | Essential | ThothOS | keeps you signed in after you have authenticated. There is one per user type so that, for example, an administrator session in one tab does not overwrite a customer session in another | 5 days |
logging_in_main | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | 5 days |
logging_in_email | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | 5 days |
logging_in_sms | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | 5 days |
logging_in_mfa | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | 5 days |
signing_up_main | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | 5 days |
signed_up_email | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | 5 days |
signed_up_sms | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | 5 days |
signed_up_mfa | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | 5 days |
recovering_account | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | up to 1 hour |
recovering_email | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | up to 1 hour |
recovering_sms | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | up to 1 hour |
recovering_mfa | Essential | ThothOS | records how far you have got through a sign-in, sign-up or account-recovery step that is still in progress, so the next screen knows the previous one succeeded. It is replaced by a session cookie when the step completes, and expires by itself if you abandon it | up to 1 hour |
signed_up | Essential | ThothOS | marks a completed sign-up so the app can finish putting you into the workspace that was just created for you | 5 days |
csrf_token | Essential | ThothOS | carries the anti-forgery value your browser must echo back on any request that changes data. It is what stops another website submitting a form as you while you are signed in | 24 hours |
_thoth_tenant_shim | Essential | ThothOS | remembers which workspace a request belongs to when the site is reached through a hostname that does not itself identify one, as on local and preview deployments, so the page loads the right workspace’s data | 8 hours |
calendar_oauth_state | Essential | ThothOS | holds the single-use anti-forgery value for a calendar connection while you are away at the provider’s own consent screen, so the account that comes back is the one that left | 10 minutes |
qbo_oauth_state | Essential | ThothOS | the same single-use anti-forgery value for connecting a QuickBooks Online account | 10 minutes |
sso_login_state | Essential | ThothOS | holds the single-use anti-forgery value while your company’s own identity provider signs you in, and remembers which company the sign-in started from | 10 minutes |
_thoth_post_auth_dest | Essential | ThothOS | remembers which page you were on when you chose to sign in — a product page on a shop we host, for example — so that finishing the sign-in returns you there instead of dropping you on a dashboard you did not ask for. It holds nothing but that address on this site, and it is deleted the moment it is used | 30 minutes |
try_build_sid | Essential | ThothOS | binds the anonymous draft you are building on our public try-it page to your browser, so the draft comes back to you and to nobody else. It is not an account and it is not linked to one | 30 minutes |
thoth_setup_plan_intent | Essential | ThothOS | remembers which plan you picked on the pricing page while you finish creating your account, so the checkout you arrive at is for the plan you chose rather than a default one | up to 1 hour |
_thoth_acq | Marketing attribution | ThothOS | records the campaign, referral or link that first brought you here, so we can tell which of our own marketing is worth continuing. It holds the utm_* values, landing page and referrer of your first visit — nothing about who you are | 30 days |
_ga | Analytics | Google Analytics | set by Google Analytics once you accept analytics, to tell one visitor’s sequence of page views from another’s | 2 years (Google’s default) |
_ga_<measurement id> | Analytics | Google Analytics | set by Google Analytics alongside the above to hold the state of the current visit for this specific property | 2 years (Google’s default) |
Your current choice: no choice recorded yet — only strictly necessary cookies are in use.
We use the third parties listed on our Sub-processor page to provide the service.
We will give you at least 30 days’ notice before a new sub-processor begins processing your data, by updating our Sub-processor page and notifying the billing contact on your account. You may object on reasonable data-protection grounds during that period; if we cannot resolve your objection, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the unused term.
Customer Data is stored and processed in the United States. We do not offer regional data-residency options, and we do not operate a European or United Kingdom storage region. If you are subject to a law that requires personal data to stay within another jurisdiction, the Service is not suitable for that data. Our sub-processors may process data in the United States on our behalf as described on the Sub-processor page.
Because we store and process data only in the United States and do not offer another region, we do not rely on Standard Contractual Clauses or any other cross-border transfer mechanism for storage. Saying so plainly is more useful than naming a mechanism we do not execute.
The Service is business software sold to companies. It is not directed at children under 13, and we do not knowingly collect personal data from a child under 13. If you believe a child under 13 has provided personal data through a company’s use of the Service, contact us and we will delete it.
Account and tenant data is retained while your account is active. If your subscription is canceled, your data remains recoverable for 30 days — reactivate any time during that window to restore full access — after which it is permanently deleted through a dependency-ordered cascade across the platform's data stores. A small set is retained by design per the schedule below — the tamper-evident audit trail and legally-required financial records. Operational audit logs are kept 90 days in the primary database and then archived to cold object storage for 7 years (integrity-hashed archive manifests; Object Lock / WORM retention on the live archive store is not yet enabled, so treat the archive as integrity-checked rather than immutable — see launch plan); change-history snapshots are kept 30 days and then 2 years. Audit-integrity findings are kept 180 days — these record that a check of the audit trail itself failed, and are retained long enough to cover a compliance sample window. If you ask us to delete your account, the account is closed immediately and the underlying records are permanently erased 30 days after we receive the deletion request; that window is the recovery period the law allows for a mistaken or unauthorized request, and it is measured on your own business calendar. API request logs are kept 90 days, and the daily API usage summaries are kept 365 days — that summary window is the ceiling on how far back usage reporting can look. Account-security records are kept 730 days: these are the sign-in, multi-factor and session-revocation events behind the security notices we send you, and because a security record a stranger could erase is worthless as evidence, they are retained through an account deletion rather than removed by it. Security-notice delivery retries are kept 14 days — an encrypted address of record held only long enough to deliver the notice, then deleted. AI prompts and generated outputs are processed transiently to serve your request and are not retained for model training. What the AI assistant remembers about your business is kept 365 days: to be useful across a conversation it records facts you tell it and facts it draws from what you have told it, each of which expires on that horizon unless it is learned again — so the assistant's memory of an abandoned detail lapses rather than accumulating indefinitely.
You can access and export your data and request its deletion from inside the product — both are self-service, and the deletion window is the one published in the retention schedule above. You can also ask us to correct inaccurate data, ask what we hold and who we share it with, and withdraw consent for the non-essential cookie categories at any time using the preference control above.
California residents have the rights to know, delete, and correct described above, and the right not to be discriminated against for exercising them. We do not sell or share personal data as those terms are used in the CCPA, and we do not use it for cross-context behavioural advertising — there is no opt-out to offer because there is nothing to opt out of.
If you are a customer, employee, or contact of a company that uses ThothOS, that company is the controller of your data: send your request to them, and we will assist them in fulfilling it. If you are not sure who to ask, write to security@thothos.net and we will route it.
To exercise any of these rights directly, contact security@thothos.net. We will respond within the time the applicable law allows, and we will tell you if we need to verify your identity first.