Privacy Policy

Thalam operates an API gateway service. This policy explains what personal data we collect, why we collect it, and what we do with it. If you have questions, email privacy@thalam.ai.

We collect the following information when you use our service:

• Account information : your email address and hashed password when you register
• Usage metadata : for each API request: the model used, number of input and output tokens, estimated cost, timestamp, and which API key was used
• Billing information : your account balance, top-up history, and Stripe payment records (Stripe handles card details directly; we never see your raw card number)
• API keys : we store a hashed version of your keys for authentication; the plaintext key is shown to you once at creation and not stored

We do not store the content of your prompts or the content of the model's responses. Your request is held in memory only for as long as it takes to route it to the model you selected and return the response to you, the prompt and response bodies are never written to our database. The only request-level data we keep is the usage metadata described in Section 2 (model, token counts, cost, timestamp, API key, and a routing trace identifier).

If an upstream provider rejects a request with an error, we may record a short technical diagnostic, such as the error status code and the request trace identifier, to investigate the failure. We do not use it to reconstruct your prompts, and it is subject to the retention limits in Section 7. What you send to AI models is your business.

This applies to API requests. In THALAM Studio and Canvas, files you upload or import, and what you generate, are stored in your Library until you delete them.

We use the data we collect to:

• Calculate and deduct credits from your balance after each request
• Display your usage history in your dashboard
• Detect and prevent abuse, fraud, and policy violations
• Send you transactional emails (account confirmation, billing receipts)
• Improve the service, for example, understanding which models are most used to prioritise infrastructure

We do not sell your data. We do not use your data for advertising. We do not use your prompts or the model's responses to train, fine-tune, or improve any AI model, ours or anyone else's.

Running this service requires sharing some data with third-party providers:

• Supabase : hosts our database and authentication system. Your account data and usage metadata are stored on Supabase infrastructure.
• Stripe : processes payments. When you top up your balance, your payment flows through Stripe. We receive a confirmation and the amount; Stripe holds your card data under their own privacy policy.
• Cloudflare : provides the edge network that routes and protects API traffic.
• Email delivery : a third-party email provider delivers transactional messages such as account, billing, and service notices.
• AI model providers : to generate a response, your request is forwarded in real time to the third-party provider that hosts the specific model you call, which processes it under its own data-handling terms. We select providers that commit not to use API inputs to train their models; some providers retain inputs briefly for security and abuse-prevention, while others retain nothing. For sensitive workloads, we recommend reviewing the terms of the specific model you rely on.

Your account data and usage metadata are stored on our managed cloud infrastructure (Supabase). This infrastructure, and the third-party model providers that fulfil your requests, may process your data in countries outside the UAE. Where personal data is transferred across borders, we rely on your consent and, where applicable, appropriate contractual safeguards. By using the service, you consent to this processing and transfer. We can provide the specific processing region on request.

If you require a specific processing region or additional data-handling assurances for a sensitive deployment, contact us at privacy@thalam.ai.

We retain your account data and usage logs for as long as your account is active. Billing records are kept for seven years to comply with financial record-keeping requirements.

If you delete your account, we delete your profile, API keys, and usage logs within 30 days. Anonymised aggregate statistics (e.g. total requests per model per day) may be retained indefinitely.

You can, at any time:

• Access the data we hold about you via your dashboard
• Delete your account and all associated data by going to your dashboard settings
• Request a copy of your usage data by emailing privacy@thalam.ai
• Ask us to correct inaccurate information

Deleting your account is permanent. Unused credits cannot be recovered after account deletion.

We use industry-standard security practices: encryption in transit (HTTPS/TLS) for all traffic and encryption at rest for stored data, hashed passwords (bcrypt), hashed API keys, and row-level security on all database tables so that each user can only access their own records.

No system is perfectly secure. If you discover a vulnerability, please report it to privacy@thalam.ai.

We may update this policy. If the changes are significant, we will notify you by email at least 14 days before they take effect. The date at the top of this page always reflects the last update.

In THALAM Canvas you can connect other apps you use: today Miro, Google Drive and chat apps such as Claude. You sign in on the app's own page, and you can disconnect at any time in Settings, Connected apps.

Miro

If you connect Miro, you sign in on Miro's own page and choose which Miro team to connect.

• What we access. With your permission, THALAM reads the boards in that team and the items on them, and adds new items to boards you can edit. We read only while you import or send, and we never change or delete anything already on your boards.
• What we store. Your Miro connection keys, encrypted so only our server can use them, and your Miro user and team identifiers. We do not store your Miro name, email or list of boards. Pictures you import are copied into your THALAM Library and kept like any file you upload. Previews shown while you choose are not stored.
• What we add to Miro. When you send work, Miro fetches each picture from a link that expires after 15 minutes and keeps its own copy. We add a new frame with the name you choose, your captions, links back to your THALAM board and, if you leave it on, a small THALAM credit.
• How we use imported pictures. Only for what you do with them in THALAM. When you use one as a reference in a generation, it is sent to the AI provider that runs that generation. We never use your Miro pictures to train AI, never use them for advertising and never sell them.
• Deletion. When you disconnect, we delete your Miro keys at once and cancel them at Miro. If you remove THALAM in Miro instead, we delete your connection within 14 business days. Pictures you imported stay in your Library until you delete them or your account; to have them all removed, email privacy@thalam.ai.

Google Drive

If you connect Google Drive, Google asks for your permission in its own window, once. THALAM asks Google only for access to the specific files you use with THALAM (Google's "drive.file" permission).

• What we access. Only the files you pick in Google's file window, a folder you pick there to save into, and the files THALAM saves to your Drive for you. THALAM cannot see or list anything else in your Drive, including what is already in a folder you pick.
• What we store. Your Google connection keys, encrypted so only our server can use them. We do not store your Google name or email; they are read from Google when they are shown to you. Files you bring in are copied into your THALAM Library and kept like any file you upload, and a Google Doc you bring in becomes a note on your board. People you share a board with can see what is on it.
• What we add to Google Drive. Only what you choose to save, in a folder named THALAM or in a folder you pick. We never change or delete your other files, and nothing is saved to your Drive automatically.
• How we use your files. Only for what you do with them in THALAM. When you use one in a generation, it is sent to the AI provider that runs that generation. We never use your Google Drive files to train AI, never use them for advertising and never sell them. THALAM's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Deletion. When you disconnect, we delete your Google keys at once and cancel THALAM's access at Google. If you remove THALAM in your Google Account instead (Third-party apps and services), we delete your connection within a day. Files you brought in stay in your Library until you delete them or your account; to have them all removed, email privacy@thalam.ai.

For company and school Google accounts. If your organisation's Google Workspace admin limits third-party apps, they can allow THALAM in the Google Admin console (Security, API controls) with its client ID: 436980946792-r7ot3g6m78571tqmvgensahmubm9inpv.apps.googleusercontent.com.

Chat apps (Claude, ChatGPT)

If you connect THALAM Canvas to a chat app such as Claude or ChatGPT, you add THALAM as a connector in that app, then sign in to THALAM and approve the connection on THALAM's own page. Only people with access to THALAM Canvas can connect.

• What the chat app can do. It can read what THALAM Canvas offers you: the models that are switched on and their prices, the voices you can use (including the names of your own voices), and your workspaces with their balances. It can build boards in THALAM Canvas from a plan it writes with you (the title, the story, the cast, the shots, their prompts and the sound), and replace a board it built until you change that board in THALAM. It cannot generate anything or spend your balance, and it cannot open your other boards, your Library, your files, your account settings or your payments: THALAM refuses its sign-in everywhere else.
• What we store. The boards it builds, like any board you make, with the story it sent kept in the board's notes. A record of each call it makes: when, which action, the app's name, whether it worked and which board it built. The record holds no story text, prompts or sign-in keys. A film sent in parts is held until its last part arrives. Your sign-in for the app is kept until you disconnect it.
• What the chat app receives. THALAM's answers: the facts listed above, a link to the board it built and what making that board would cost. The chat app keeps your conversation, including these answers, under its own terms and privacy policy.
• How we use it. Only to build your boards and to keep the service working and safe. We never use your stories or prompts to train AI, never use them for advertising and never sell them.
• Disconnecting. In Settings, Connected apps, Disconnect ends the app's sessions at once, and THALAM refuses its next call. Boards it built stay in your workspace until you delete them. To have your call records removed, email privacy@thalam.ai.

Miro is a trademark of RealtimeBoard, Inc. Google Drive is a trademark of Google LLC. Claude is a trademark of Anthropic, PBC. ChatGPT is a trademark of OpenAI. THALAM is not affiliated with or endorsed by Miro, Google, Anthropic or OpenAI. Your use of Miro, Google Drive, Claude and ChatGPT is governed by their own terms and privacy policies.

Privacy questions or data requests: privacy@thalam.ai

For legal matters, see our Terms of Service.