Privacy Policy
This policy explains what personal information THALIQ S.A.C. (“Thaliq”, “we”, “our”) collects and how we use it when you visit our website (thaliq.com), use our console (console.thaliq.com) or call our APIs and SDKs. This is a beta version, written in plain language.
Beta draft · Version 2026-10-beta.3 · Effective date: To be confirmed
Scope
Thaliq is operated by THALIQ S.A.C., a company incorporated in Peru (RUC 20616300271, registered address [TO CONFIRM]). THALIQ S.A.C. is the controller of the personal data described in this policy: the data of website visitors, of the members of customer organizations and of the people who contact us.
When a customer uses Thaliq to talk with its own end users, the conversations and the end users’ data belong to that customer. For that data the customer is the controller and Thaliq is its processor, under our Data Processing Addendum. If you are an end user of one of our customers, contact that customer first about your data.
Information we collect
Information you give us
- Account information when you sign up: name, work email, company, country, language and a password (we store only a hash of it).
- Billing details that the owner of an organization gives us so that we can invoice it: legal name, tax ID, address and billing email. We do not process or store card numbers.
- Contact information when you reach out through the form on our website or by email: name, email, company and the content of your message.
- Your organization’s content: the configuration of agents and tools, the sources of knowledge bases and the credentials you store as secrets, which we encrypt.
- Communications with our team: emails and support requests.
Information collected automatically
- Technical data when you visit our website or use the console: IP address, browser type, operating system, pages visited and referring URL.
- Security data: the IP address and browser details at sign-up and sign-in, the failed attempts we count to stop abuse, sessions, and an audit log of the changes made in an organization.
- Proof of acceptance: when you accept a legal document we record which document and version, when, and your IP address and browser details.
- Usage data: the agents that run, tokens used, errors and performance metrics. We use them to operate the service, bill for it and improve it.
- Cookies and similar technologies, as described below.
Information about your end users
Customers can send us the messages of their end users, identifiers (such as a phone number on WhatsApp or an identifier the customer defines), attributes and feedback. We process this information only on the customer’s instructions, as its processor.
How we use information
- Provide and operate the service: sign-in, running agents, billing and support.
- Keep the service secure: prevent abuse, fraud and spam, and apply rate limits.
- Improve the service: find bugs, measure performance and plan capacity.
- Communicate with you: sign-in codes, invitations, statements, service notices, support replies and product updates.
- Comply with the law: respond to lawful requests, enforce our Terms and keep the records the law requires.
We do not sell personal information. We do not use customer conversations or agent outputs to train general-purpose AI models. A customer’s data stays within that customer’s organization.
Legal basis for processing
In Peru we process personal data under Law No. 29733 on the Protection of Personal Data and its regulations, on the basis of your consent, of the contract you entered into with us, or of another basis the law allows.
If you are in the European Economic Area or the United Kingdom, we process your information under one of these legal bases:
- Performance of a contract: to provide the service you signed up for.
- Legitimate interest: to improve the service, secure it against abuse and contact you about your account.
- Consent: for optional things like marketing emails. You can withdraw consent at any time.
- Legal obligation: to comply with tax, accounting and law-enforcement requirements.
Data retention
- Account data: kept while your organization is active. After a deletion request it is kept for a 30-day grace period, during which the owner can cancel, and then deleted.
- Conversation and run content (messages, tool results and similar payloads): 30 days by default, or the period an agent sets, and then deleted automatically. Metadata such as timestamps, token counts, costs and status is kept for up to 12 months.
- Audit log of the changes made in an organization: 12 months.
- Billing records: for the period that tax law requires, which in Peru is generally at least 5 years. [TO CONFIRM]
- Proof of acceptance of legal documents: until the organization is deleted.
- Backups: automated database backups are kept for up to 14 days; deleted data leaves them on that cycle.
- Sign-up requests that are never completed: 7 days. Contact form messages: as long as needed to follow up, then archived in our CRM under its retention rules.
Your rights
Depending on where you live, including under Peru’s Law No. 29733 and, where it applies, the GDPR, you have the right to:
- Access the personal information we hold about you.
- Correct information that is wrong or out of date.
- Cancel (delete) your information, subject to legal exceptions.
- Receive your information in a structured format and move it to another service.
- Object to certain processing, or restrict it.
- Withdraw your consent for optional processing.
- Lodge a complaint with your data protection authority; in Peru, the National Authority for Personal Data Protection.
To exercise any of these rights, email [email protected]. We respond within the time the law sets and in any case within 30 days. We may need to verify your identity before acting on a request.
If your data is in a customer’s agent, send your request to that customer. We will help the customer respond.
International transfers
Our infrastructure is in the AWS region us-east-1, in the United States. Requests to the language model go through Amazon Bedrock with a cross-Region inference profile, so a request can be processed in an AWS Region other than us-east-1. [TO CONFIRM: regions and AWS terms]
When we transfer personal data out of Peru, the European Economic Area, the United Kingdom or other jurisdictions with transfer restrictions, we rely on the safeguards the law allows, such as Standard Contractual Clauses. [TO CONFIRM]
Security
We protect personal information with encryption in transit and at rest, isolation between organizations in our database, hashed passwords and credentials, role-based access and an audit log. No system is perfectly secure. If a breach affects your data, we will notify you as the law requires.
Children’s privacy
Thaliq is a product for businesses and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
Changes to this policy
We may update this policy. Each update is a new version of the document. For material changes we will notify customers by email at least 30 days before they take effect.
Contact
Questions or requests about this policy: [email protected]. We answer in plain language first and in legal language second.