Last updated: March 14, 2026
ThesisOS (“Company,” “we,” “us”) operates ThesisOS.ai (the “Platform”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Platform. By using ThesisOS, you consent to the data practices described in this policy.
When you use the Platform, your inputs are processed by AI language models to generate business plans, strategies, projections, and deliverables. The AI processes your business type, budget, timeline, feature preferences, target audience, monetization choices, and description to produce outputs. Your inputs may be used to improve the quality and accuracy of AI-generated outputs across the Platform, but will be aggregated and anonymized before use in model training.
We use collected information for the following purposes:
We do not sell your personal information. We may share data with:
We retain your account data and generated business plans for as long as your account is active. After account deletion, we retain anonymized usage analytics for up to 24 months for Platform improvement. Payment records are retained as required by financial regulations (typically 7 years). You may request deletion of your personal data at any time (see Section 8).
We implement industry-standard security measures including: TLS encryption in transit, AES-256 encryption at rest, secure authentication via Supabase Auth, PCI-DSS compliant payment processing via Stripe, regular security audits, and access controls based on the principle of least privilege. However, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.
We use the following types of cookies:
You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Platform.
Under the General Data Protection Regulation, you have the right to:
Legal Basis for Processing: We process your data based on: (a) contract performance (service delivery), (b) legitimate interests (Platform improvement, security), and (c) consent (marketing communications).
Under the California Consumer Privacy Act, you have the right to:
Categories of Information Collected: Identifiers (name, email, IP), commercial information (purchase history), internet activity (usage data), and inferences (AI-generated business profiles).
To exercise any of these rights, contact us at privacy@thesisOS.ai. We will respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before processing your request.
Your data may be processed in the United States and other countries where our service providers operate. For EU/EEA residents, we ensure adequate safeguards for international transfers through Standard Contractual Clauses (SCCs) and data processing agreements with all sub-processors.
ThesisOS is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or Platform notification at least 30 days before they take effect. Your continued use after changes constitutes acceptance.
For privacy-related inquiries, data requests, or complaints:
If you are an EU/EEA resident and believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority.