Privacy policy

This Privacy Policy explains how Fairspleet LLC ("Fairspleet," "we," "us," or "our"), the Dubai-registered company that owns and operates Thally, collects, uses, shares, and protects personal data when you visit thally.io, use Thally Cloud, contact us, or otherwise interact with services that link to this policy (collectively, the "Services").

Scope

This policy applies to the Thally Services operated by Fairspleet. It does not apply to a self-hosted Thally deployment that a customer or community member operates on infrastructure they control. The operator of a self-hosted deployment is responsible for its own privacy practices.

When an organization uses Thally Cloud to publish documentation or connect a repository, we may process personal data on that organization's behalf. In that context, the organization controls the data and your privacy request should normally be directed to it. This policy covers the information Fairspleet controls for account administration, billing, product operation, security, and our own business purposes.

Personal data we collect

Information you provide

Account and workspace information: your name, email address, organization, workspace membership, role, and account preferences.
Billing information: billing contact details, plan, subscription status, transaction records, and tax information. Payment card details are collected and processed by our payment provider; Fairspleet does not store complete card numbers.
Customer content: documentation, configuration, files, prompts, instructions, feedback, and other content you submit to the Services.
Repository and integration information: repository names, organization names, installation identifiers, pull request and issue metadata, commit information, and credentials or tokens needed to operate integrations you enable.
Communications: messages you send to support, sales, or legal; survey responses; and other correspondence.

Information collected automatically

When you use the Services, we may collect:

IP address, browser and device type, operating system, language, referring page, and approximate location derived from IP address;
pages and features viewed, dates and times of access, session activity, error reports, and security logs;
documentation analytics such as page views, human or agent traffic classification, search terms, search result interactions, API or discovery requests, page feedback, and chat activity; and
cookie and similar-technology data described in the Cookies section below.

Information from third parties

We may receive information from:

Identity providers when you sign in, such as your verified email address and basic profile information;
GitHub and other integrations that you authorize, including account, organization, repository, issue, pull request, and installation information;
payment providers regarding subscription and payment status; and
workspace administrators or teammates who invite you to or manage a workspace.

How we use personal data

We use personal data to:

provide, maintain, secure, and troubleshoot the Services;
create and administer accounts, workspaces, roles, subscriptions, and integrations;
host and deliver documentation and process customer instructions;
provide search, documentation analytics, AI answers, and documentation-drafting features;
generate pull requests and other actions you request through connected repositories;
process payments, prevent fraud, and maintain financial records;
communicate about the Services, including transactional, security, support, and product messages;
understand product usage and improve performance, reliability, and usability;
enforce our Terms of Service and protect the rights, safety, and integrity of Fairspleet, Thally users, and others; and
comply with law and respond to valid legal requests.

Where applicable law requires a legal basis, we process personal data as necessary to perform our contract with you, comply with legal obligations, protect our legitimate interests or those of others, and, where required, with your consent. Our legitimate interests include operating and improving the Services, securing our systems, preventing abuse, and communicating with customers. You may withdraw consent at any time where processing is based on consent.

You can opt out of marketing emails by using the unsubscribe link in the message or contacting us. You may still receive transactional, billing, security, and other service-related messages.

AI features

If you use an AI feature, we process the prompts, instructions, relevant documentation or repository context, retrieved passages, and generated output needed to provide that feature. We use models provided by Anthropic and OpenAI to process this information on our behalf.

Fairspleet does not use customer content, prompts, repository content, documentation, or AI output to train AI models. We use provider services and settings under which content submitted through Thally is not used to train Anthropic's or OpenAI's general-purpose models.

AI output can be inaccurate and should be reviewed before you rely on, publish, or merge it. Thally's documentation agent is designed to create reviewable changes and does not merge changes on its own.

Do not submit sensitive personal data, regulated data, or confidential information to an AI feature unless you are authorized to do so and the feature is appropriate for that data.

We may share personal data with:

service providers that help us with hosting, storage, authentication, payments, email, customer support, security, analytics, and AI processing, including Anthropic and OpenAI for AI features;
integrations you direct us to use, such as GitHub or your identity provider;
workspace owners, administrators, and members according to workspace roles and settings;
the public, when you or your organization publish documentation or otherwise choose to make content public;
professional advisers and authorities when reasonably necessary to comply with law, protect rights or safety, or establish, exercise, or defend legal claims; and
a successor or transaction participant in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising or use it to serve third-party targeted advertisements.

Customer-controlled and public content

Workspace customers decide what documentation and repository content to submit, connect, and publish. Public documentation and public repository content may be indexed, copied, or used by other people and services, including search engines and AI agents. Fairspleet cannot control how third parties use information after it has been made public.

If an organization has provided your personal data to Fairspleet through a Thally workspace, repository, or documentation, contact that organization first to exercise your rights. We will assist the organization as required by applicable law and our agreement with it.

Cookies and similar technologies

We use cookies and similar technologies that are necessary to:

keep you signed in and maintain secure sessions;
complete authentication and prevent fraud;
remember preferences such as theme or interface settings; and
operate and understand use of the Services.

You can control cookies through your browser settings. Blocking essential cookies may prevent account sign-in or other parts of the Services from working.

Some browsers offer "Do Not Track" or Global Privacy Control signals. Because we do not sell personal data or share it for cross-context behavioral advertising, there is no sale or advertising-related sharing to opt out of. Where applicable law requires a different response to a browser signal, we will honor that requirement.

Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide the Services, comply with legal and accounting obligations, resolve disputes, and enforce agreements.

Retention depends on the type of information and why we process it. Account, workspace, and customer content is generally retained while the relevant account or workspace is active. Some information may remain for a limited period in backups, security logs, transaction records, or records we must keep by law. We may retain de-identified or aggregated information that can no longer reasonably identify you.

International data transfers

Fairspleet and its service providers may process personal data in countries other than the country where you live. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers and take steps designed to protect personal data consistently with this policy.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data. These measures include access controls, encrypted network connections, and controls appropriate to the sensitivity of the data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

You are responsible for protecting your credentials, limiting repository and workspace access, and promptly notifying us if you believe an account or integration has been compromised.

Your privacy rights

Depending on where you live, you may have the right to:

access or obtain a copy of your personal data;
correct inaccurate personal data;
delete personal data;
restrict or object to certain processing;
receive certain data in a portable format;
withdraw consent where processing is based on consent; and
appeal or complain to a data-protection authority.

You may also have the right to know the categories of personal data we collect, the sources and purposes of collection, and the categories of recipients. We will not discriminate against you for exercising a privacy right.

To make a request, email legal@thally.io. We may need to verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law. Some information may be exempt from a request, including where retention is required by law or needed to protect security and legal rights.

Because we do not sell personal data or share it for cross-context behavioral advertising, there is no need to opt out of those activities.

Children

The Services are intended for business and professional use and are not directed to children. You must be at least 18 years old, or the age of legal majority where you live, to create an account. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, contact legal@thally.io so we can investigate and take appropriate action.

Third-party services

The Services may link to or interoperate with third-party services. Their privacy practices are governed by their own policies. Review the permissions and privacy terms of a third-party service before connecting it to Thally.

Changes to this policy

We may update this policy as the Services or applicable laws change. We will post the revised policy here and update the date above. If a change materially affects your rights, we will provide additional notice when required by law.

Contact us

For privacy requests and legal questions, email legal@thally.io.

For general, support, or account questions, email team@thally.io.

Mail: Fairspleet LLC, 348 Business Bay, Dubai, UAE.