Thaura Privacy Policy
Last updated: 20 October 2026.
1. Preamble
Thaura GbR ("we", "us", or "Thaura") commits to protecting your privacy in accordance with:
- General Data Protection Regulation (GDPR) 2016/679
- German Federal Data Protection Act (BDSG)
- Principles of the Thaura Constitution
2. Core Product Data Processing
2.1 Fundamental Principles
- Encryption: Your conversations, files, memories, projects and connector sign-ins are encrypted by our application with AES-256-GCM where we store them; the working copy of a file on a chat's own computer is protected by that server's disk encryption. The disks of our app, chat and storage servers are encrypted, and the GPU servers that run the model keep no conversations on disk. Data between your device and us travels over TLS 1.2 or newer, and inside our private network files move already encrypted.
- Staff Access: Our team does not read your conversations. Our software decrypts them only to answer you. The only exceptions are an answer you send us yourself with feedback, and a page you shared publicly that someone reports to us: our team reads those to review them.
- No Sharing: conversation content is never shared with advertisers, analytics services, or external training providers.
- No Training with User Data: Your interactions are never used for model improvement.
- No Ads or Trackers: There are no ads and no third-party trackers. We count how Thaura is used in aggregate, for example how many messages are sent, to run and improve the service.
- No Surveillance Cooperation: We do not take part in surveillance programs or bulk data requests. We disclose data to authorities only when the law compels us to.
- Marketing Emails: We send occasional news and offers to your account's email address. You can stop them at any time in Settings or with the unsubscribe link in each email.
- Locality: All servers are located in the EU.
2.2 Collected Data
| Data Category | Purpose | Retention Period | Legal basis |
|---|---|---|---|
| Account Data (Email) | Authentication | Until account deletion | Contract (Art. 6(1)(b) GDPR) |
| Profile and settings (your name, profile picture, language and preferences), and API keys (a fingerprint and the first characters), their usage and your API balance | Running your account and the API | Until you delete them or your account | Contract (Art. 6(1)(b) GDPR) |
| Conversations and files (including project files and uploads) | Answering you and keeping your history | Until you delete them or your account; then erased from our storage within 30 days | Contract (Art. 6(1)(b) GDPR) |
| Memory (what Thaura remembers about you, kept as topics; on by default. You can read or delete each topic, reset it all, turn it off, start a chat with memory off, and choose for each project whether it uses your account's memory. Sensitive details, such as your health (an allergy included), your religion or your political views, are saved only when you ask Thaura to remember them) | Making answers fit you across chats | Until you delete it, reset it or delete your account | Legitimate interests (Art. 6(1)(f) GDPR) |
| Metadata (IP, Device type) | Security & Compliance | 30 days | Legitimate interests (Art. 6(1)(f) GDPR) Legal obligation (Art. 6(1)(c) GDPR) |
| When you use Thaura: the times you open the app (at most one record every 15 minutes) and, on the Free plan, the time of each message you send | The Free plan's message limit, counting active accounts, and account emails you can turn off | 90 days | Contract (Art. 6(1)(b) GDPR) Legitimate interests (Art. 6(1)(f) GDPR) |
| Feedback you send about an answer or a shared page (your note, the kind you choose, and the answer or page it is about; nothing from incognito chats, where only your note is kept; about a shared page you can send it without an account), and the reason you give if you cancel a plan | Improving Thaura | 12 months | Legitimate interests (Art. 6(1)(f) GDPR) |
| Error reports from the apps (how the error surfaced, the app and its version, the kind of page, and the error's own text with anything personal removed; never your messages, files, account or IP address) | Finding and fixing faults in Thaura | 14 days; counts with no identifier up to 25 months | Legitimate interests (Art. 6(1)(f) GDPR) |
| Speed measurements from the apps (how long pages, chats and answers take to appear, the app, the kind of page, and your device's memory, processor count and connection type; never your messages, files, account or IP address) | Making Thaura faster | Not kept as reports; counts with no identifier up to 25 months | Legitimate interests (Art. 6(1)(f) GDPR) |
| Desktop app sign-ins (the computer's name, its system, the app version, and when it was signed in and last connected) | Letting Thaura reach your computer, and listing your devices in Settings so you can sign them out | Until you sign that app out, its sign-in expires, or you delete your account | Contract (Art. 6(1)(b) GDPR) |
| Data exports you ask for in Settings > Export data (a ZIP file of your account's data, and when you asked) | Giving you a copy of your data (your rights of access and portability), one export a day | The file is deleted 24 hours after we email you its link (at once if it could not be made or sent); the record of when you asked stays until you delete your account | Legal obligation (Art. 6(1)(c) GDPR) |
| Reports you send, and reports about your content with what our team decided (the reason, your note, the answer or shared page reported, and an email address if you leave one) | Reviewing reports and acting on illegal content (EU Digital Services Act) | 2 years, also after you delete your account | Legal obligation (Art. 6(1)(c) GDPR) Legitimate interests (Art. 6(1)(f) GDPR) |
| Messages you send us through the contact page or by email (your name, email address and message) | Answering you | In our inbox, as long as needed to answer you, and at most 3 years | Contract (Art. 6(1)(b) GDPR) Legitimate interests (Art. 6(1)(f) GDPR) |
| Your choice about news and offers by email (yes or no, when and where you made it, and the wording you saw) | Sending occasional news and offers by email to account holders who haven't unsubscribed, and keeping a record of each choice | Until you delete your account; then only your choices, their dates and the wording you saw, under a coded form of your email address, for 3 years, to show what you chose | Legitimate interests (Art. 6(1)(f) GDPR) Legal obligation (Art. 6(1)(c) GDPR) |
| If you mark one of our emails as spam: a coded form of your email address | Never emailing that address again | Kept, also after you delete your account | Legitimate interests (Art. 6(1)(f) GDPR) |
| Invoices and payment records (kept by our payment provider, Stripe, not by us; we never see your full card number) | Billing, tax and accounting | Stripe keeps them for as long as tax and accounting law requires, also after you delete your account. We keep no copies of our own | Contract (Art. 6(1)(b) GDPR) Legal obligation (Art. 6(1)(c) GDPR) |
The last column names the legal basis under Art. 6(1) GDPR: a contract, to give you the service you signed up for; our legitimate interests, to run, secure and improve it; your consent; or a legal obligation. You need an email address to have an account; everything else you give us is up to you.
3. Special Features
3.1 Artifacts
- Generated content is provided exclusively to you
- No reuse by Thaura without explicit consent
4. Your rights under the GDPR
- Access: Full disclosure of all stored data. Download a copy yourself in Settings > Export data, or ask info@thaura.ai.
- Rectification: We correct inaccurate data without undue delay
- Erasure: Delete your account and everything in it yourself in your account settings, or ask us and we will do it within 30 days. A deleted chat or file disappears from your account immediately and is erased from our storage within 30 days; so is everything in a deleted account. If you have a Pro or Max plan, it ends now, with no refund. We keep only records of reports and moderation decisions, for two years; your answers about marketing email, under a coded form of your email address, for three years; and, if you marked one of our emails as spam, a coded form of your address, so we never email it again. Your invoices are kept by our payment provider, Stripe, for as long as tax and accounting law requires; we keep no copies of our own.
- Restriction: You can ask us to restrict how we use your data, for example while a question about its accuracy is settled, at info@thaura.ai.
- Objection: You can object at any time to what we do on the basis of our legitimate interests, at info@thaura.ai. We then stop, unless we have compelling legitimate grounds that the law recognizes.
- Portability: Download a copy of your personal data in a machine-readable format (JSON, Markdown and your original files) in Settings > Export data, or ask info@thaura.ai and we'll send it to you.
- Withdrawing consent and objecting: You can withdraw any consent you gave at any time, and stop news and offers by email at any time, in Settings or with the unsubscribe link in each email. This does not affect what we did before.
- Complaint: You can complain to a data protection authority. Ours is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.
Automated decisions: We make no decisions about you based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).
5. Third Parties & Subprocessors
We only work with partners who:
- Comply with EU data protection standards
- Transfer data outside the EU only under an adequacy decision (for the USA, the EU-US Data Privacy Framework) or the EU's standard contractual clauses, as named for each partner below
- Are contractually obligated to deletion
Current list (2026):
- Hetzner (app hosting, each chat's computer and file storage, Helsinki, Finland; encrypted backups, Falkenstein, Germany)
- Scaleway (turning voice dictation into text, Paris, France)
- Verda Cloud Oy (self-hosted AI inference, Helsinki, Finland)
- Stripe (payments; Stripe Payments Europe, Ireland, part of a US company; data that goes to Stripe in the USA is covered by the EU-US Data Privacy Framework and the EU's standard contractual clauses)
- Resend (account emails, sent from its EU region; a US company, certified under the EU-US Data Privacy Framework, with the EU's standard contractual clauses in its terms)
- Proton (our email inboxes, Switzerland, which the EU recognizes as protecting data adequately)
- JOIN (job applications, only if you apply to work with us; JOIN Solutions AG, Switzerland, which the EU recognizes as protecting data adequately)
Web search uses Brave Search (Brave Software, Inc., USA). Our servers send Brave only the search words, with no information about you: no account, no email and not your IP address. So Brave cannot link a search to you. The assistant writes the search words from your conversation, so they can contain something from it, such as a name or a topic. Brave keeps a record of search words for up to 90 days. Brave is not a sub-processor.
Connectors you add receive what you send them through Thaura, under their own terms and privacy policies.
6. Controller and contact
Controller:
Thaura GbR, represented by its partners Said Chihabi and Hani Chihabi
Fortunastr. 23 A, 30451 Hannover, Germany
info@thaura.ai
info@thaura.ai is our address for everything, data protection requests included.
We'll tell you about important changes to this policy in advance, by email or in the app, with a reasonable notice period.