Privacy Policy

Thula Technologies, Inc. ("Thula," "we," "us," or "our") is committed to protecting your personal information and maintaining the highest standards of data privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our AI financial operations platform and related services (collectively, the "Service").

This policy applies to all users of the Thula platform, including businesses and individuals who access the Service on behalf of an organization. By accessing or using the Service, you agree to the collection and use of information in accordance with this policy.

If you do not agree with the terms of this Privacy Policy, please discontinue use of the Service immediately.

Account Information: When you are onboarded to Thula, we collect your name, email address, company name, job title, and billing information necessary to establish and maintain your account.

Business & Financial Data: To provide our core AI financial operations capabilities, we access financial data you authorize through connected integrations (e.g., QuickBooks, Stripe, Xero, bank feeds). This may include transaction histories, income statements, balance sheets, accounts receivable/payable, and payroll summaries. We do not store raw banking credentials or login passwords for third-party systems.

Usage & Behavioral Data: We automatically collect information about how you interact with our platform, including pages and features accessed, queries submitted to the AI, session duration, device type, browser type, IP address, and timestamps.

Integration Metadata: When you connect third-party services, we collect metadata about those connections, including connection status, last sync time, and error logs, to ensure reliable data pipelines.

Communications: If you contact us via email, chat, or through the platform, we retain records of those communications to improve support and resolve issues.

Onboarding Information: Information provided during the onboarding consultation — including business goals, financial challenges, revenue ranges, and team structure — is stored to personalize your Thula experience.

We use the information we collect to:

• Provide, operate, and maintain the Service and all associated features
• Generate AI-powered financial insights, forecasts, and executive reports
• Personalize your experience based on your business profile and usage patterns
• Process transactions and send billing-related communications
• Monitor and maintain the performance, security, and reliability of the Service
• Improve our AI models and analytical capabilities using aggregated, de-identified data
• Send operational notifications, product updates, and service announcements
• Comply with applicable legal obligations and regulatory requirements
• Detect, investigate, and prevent fraud, abuse, or security incidents
• Respond to your support requests and feedback

We do not use your financial data to train general-purpose AI models shared across unrelated customers. Your data powers your insights only.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases:

• Contract Performance: Processing necessary to deliver the Service under your agreement with us.
• Legitimate Interests: Improving the Service, security monitoring, and fraud prevention.
• Legal Obligation: Compliance with applicable laws and regulations.
• Consent: Where we have obtained your explicit consent, such as for optional marketing communications.

We do not sell, rent, or trade your personal information to third parties. We may share information with:

• Service Providers: Trusted third-party vendors who assist us in operating the Service — including cloud infrastructure, analytics, payment processing, and customer support — under strict data processing agreements and confidentiality obligations.
• Integration Partners: When you connect third-party financial tools, limited data is exchanged as necessary to maintain and synchronize those connections per your authorization.
• Legal Requirements: When required by applicable law, court order, subpoena, or governmental authority, we may disclose information as legally compelled.
• Protection of Rights: To enforce our Terms of Service, protect the rights and safety of Thula, our users, or the public, and investigate potential violations.
• Business Transfers: In connection with a merger, acquisition, financing, or sale of company assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice if such a transfer materially changes how your data is handled.

We implement rigorous security measures to protect your information from unauthorized access, disclosure, alteration, or destruction:

• All data in transit is encrypted using TLS 1.2 or higher
• Data at rest is encrypted using AES-256
• Access to customer data is restricted to authorized personnel on a need-to-know basis
• We conduct regular security assessments and vulnerability testing
• Multi-factor authentication is enforced for platform access
• We maintain audit logs of data access and changes

Despite these measures, no method of transmission or electronic storage is 100% secure. We encourage you to use strong passwords and contact us immediately if you suspect unauthorized access to your account.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data is retained for the duration of your subscription and for up to 7 years after termination for legal and tax compliance purposes.
• Financial data synced from integrations is retained per your configured sync window and deleted upon account closure unless retention is required by law.
• Usage logs are retained for up to 24 months for analytics and security purposes.
• Support communications are retained for up to 3 years.

You may request deletion of your account and associated data at any time. Where deletion is legally permissible, we will process your request within 30 days.

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your data, subject to legal retention obligations.
• Restriction: Request that we limit how we process your data in certain circumstances.
• Portability: Request your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of personal information are collected and the right to opt out of the sale of personal information (we do not sell personal information).

To exercise any of these rights, contact us at privacy@trythula.com. We will respond within 30 days.

We use cookies and similar technologies (pixels, local storage, session tokens) for the following purposes:

• Essential Cookies: Required for authentication, session management, and core platform functionality. Cannot be disabled.
• Analytics Cookies: Used to understand how users navigate the platform and identify areas for improvement. These are anonymized where possible.
• Preference Cookies: Store your settings and preferences to personalize your experience.

You can manage non-essential cookies through your browser settings. Disabling certain cookies may affect platform functionality. We do not currently use cookies for advertising or cross-site tracking.

The Service may contain links to third-party websites or integrate with third-party platforms. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you connect to Thula. We are not responsible for the privacy practices of third parties.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided personal information, we will promptly delete it. If you believe a minor has submitted information to us, contact us at privacy@trythula.com.

Thula Technologies, Inc. is headquartered in the United States. If you access the Service from outside the U.S., your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate. We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses where required by applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on this page with a new effective date
• Sending an email notification to your registered address for significant changes
• Displaying a prominent in-platform notice where appropriate

Your continued use of the Service after the effective date of any changes constitutes acceptance of the revised policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Team:

Thula Technologies, Inc.
Attn: Privacy Team
42074 Miranda Street
Fremont, CA 94539
privacy@trythula.com

We are committed to resolving privacy concerns promptly and will respond to all inquiries within 30 business days.